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ABSTRACT 


This  thesis  studies  ways  in  which  the  Naval  Audit  Service  can  adapt 
microcomputers  and  microcomputer  software  to  audit  and  audit-related  work.  It 
discusses  the  introduction  and  implementation  of  microcomputers  in  the  Naval  Audit 
Service.  It  also  surveys  current  software  from  three  sources-commercial,  government 
and  public  domain.  During  the  software  survey,  it  evaluates  the  usefulness  of  that 
software  for  Naval  Audit  Service  audit  applications.  A  survey  of  current  audit  practices 
using  microcomputers  was  conducted  in  public  accounting  firms,  audit  departments  in 
industry,  the  Naval  Audit  Service  and  federal  government  agencies  other  than  the 
Naval  Audit  Service.  Finally,  this  thesis  makes  recommendations  for  the 
implementation  and  efficient  use  of  microcomputers  in  the  Naval  Audit  Service. 
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THESIS  DISCLAIMER 


The  reader  is  cautioned  that  computer  programs  developed  in  this  research  may 
not  have  been  exercised  for  all  cases  of  interest.  While  every  effort  has  been  made, 
within  the  time  available,  to  ensure  that  the  programs  are  free  of  computational  and 
logic  errors,  they  cannot  be  considered  validated.  Any  application  of  these  programs 
without  additional  verification  is  at  the  risk  of  the  user. 
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I.  THESIS  INTRODUCTION  AND  BACKGROUND 


A.  INTRODUCTION 

The  purpose  of  this  thesis  is  to  identify  specific  ways  the  Naval  Audit  Service  can 
use  microcomputers  to  increase  the  efficiency  of  accomplishing  audit  and  audit 
management  tasks.  The  tasks  addressed  in  this  thesis  are  performed  on  all  types  of 
audits  and  cover  all  areas  of  the  audit  process.  The  research  emphasis  is  on  how 
microcomputers  can  be  used  by  all  auditors  to  increase  their  productivity  and  quality 
of  audit  results.  This  thesis  topic  was  proposed  by  Naval  Audit  Service  headquarters 
personnel.  Research  was  concentrated  in  four  areas.  These  areas  were  ( 1 )  a  review  of 
alternatives  fdr  automating  audit  procedures  and  integrating  microcomputers  into  the 
Naval  Audit  Service,  (2)  current  software  applications  and  programs  available  for 
auditing,  (3)  analysis  of  what  audit  procedures  can  be  performed  with  microcomputers, 
and  (4)  microcomputer  usage  by  auditors  in  public  accounting  firms,  private  industry, 
the  Naval  Audit  Service  and  other  federal  agencies.  There  were  specific  areas  of 
microcomputer  usage  that  were  not  reviewed.  These  included  hardware  capabilities 
and  configurations,  training  of  microcomputer  users,  and  security  of  hardware  and 
software  assets.  Explanation  of  the  technical  aspects  of  automated  data  processing 
(ADP)  and  discussion  of  audit  issues  were  also  avoided  in  our  research  and  final  ' 
recommendations. 

B.  BACKGROUND 

The  Naval  Audit  Service  is  responsible  for  internal  audit  work  performed  in  all 
Navy  and  Marine  Corps  activities.  The  Naval  Audit  Service  s  charter  to  perform  such 
work  is  given  in  SECNAVINST  7510. TC.  [Ref.  1]  Internal  audit  is  defined  as  review  of 
programs  for  compliance  with  rules  and  regulations,  adequacy  of  controls,  and 
operational  effectiveness.  All  organizational  components  and  levels  of  Navy  and 
Marine  Corps  activities  are  subject  to  Naval  Audit  Service  review.  Every  aspect  of 
these  activities'  operations  are  subject  to  audit  by  the  Naval  Audit  Service.  These 
audits  are  performed  in  regular  intervals  of  three  to  five  years.  In  addition,  audits  of 
selected  functions  are  performed  service  wide  and  upon  request  by  Navy  and  Marine 
Corps  management. 


Naval  Audit  Service  is  organized  with  its  Headquarters  located  in  Falls  Church, 
Virginia  and  four  regional  offices.  The  regional  offices  are  further  subdivided  into  audit 
divisions  composed  of  two  or  more  audit  sites  and/or  mobile  audit  teams.  The  audit 
sites  are  located  at  various  Navy  and  Marine  Corps  activities  both  in  the  United  States 
and  overseas.  There  are  approximately  600  auditors  at  these  various  locations.  The 
auditors  at  the  audit  sites  perform  audits  at  those  locations  and  geographically  separate 
Navy  and  Marine  Corps  installations.  The  auditors  are  expected  to  perform  all  types 
of  audits  and  are  regularly  transferred  among  various  sites  and  audit  teams,  as  needed. 
The  audit  work  performed  includes  operational  audits  of  activity  functions  and 
programs,  financial  audits  of  selected  activities,  and  special  reviews  requested  by  Navy 
and  Marine  Corps  management.  The  only  exception  to  this  generalist  policy  is  in  the 
area  of  data  processing.  Here  special  audit  teams  concentrate  mostly  on  data 
processing  audits.  However,  these  auditors  are  not  extensively  trained  in  the  area  of 
data  processing. 

The  Navy  and  Marine  Corps  are  increasing  their  use  of  computers  in  all  phases 
of  their  operations.  This  increased  automation  has  changed  the  traditional  audit  trail, 
changed  the  types  of  data  available  and  increased  the  quantity  of  data  for  review. 
These  factors  make  the  traditional  manual  review  by  auditors  difficult  and  sometimes 
impossible  to  accomplish.  Naval' Audit  Service's  audit  workload  keeps  increasing  as 
the  Navy  and  Marine  Corps  grow.  Also,  the  increased  emphasis  on  prevention  and 
detection  of  fraud,  waste  and  abuse  requires  thorough  audits  and  timely  reporting  of 
results.  In  recognition  of  the  change  in  the  audit  evidence  and  the  potential  for 
increase  in  audit  productivity,  Naval  Audit  Service  started  buying  microcomputers  for 
use  by  its  auditors  and  audit  managers.  Previously,  microcomputers  were  not  used  by 
auditors  at  audit  sites  or  in  the  field.  They  were  used  in  regional  and  audit  service 
headquarters  only.  They  were  used  for  word  processing,  personnel  management  and 
tracking,  and  budgeting.  Thirty-seven  luggable  IBM-compatible  microcomputers  were 
purchased  in  Fiscal  Year  1986.  It  is  anticipated  that  an  additional  forty-six 
microcomputers  will  be  purchased.  This  would  provide  one  microcomputer  for  about 
every  five  auditors.  The  hardware  configuration  of  the  systems  purchased  includes  a 
central  processing  unit  with  256K  of  Random  Access  Memory  (RAM)1  and  two  5  14 
inch  floppy  disk  drives,  a  10  megabyte  hard  disk  drive  and  an  external  modem. 
Software  purchased  with  the  system  includes  an  operating  system,  word  processing, 

^ee  Appendix  A  for  a  further  explanation  of  RAM. 
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spreadsheet,  statistical  analysis,  and  data  base  packages.  The  Naval  Audit  Service 
purchased  these  microcomputers  for  use  by  their  auditors  and  audit  managers.  They 
will  be  used  for  audit  and  administrative  functions.  In  addition,  the  microcomputers 
will  be  used  in  a  stand-alone  mode  as  well  as  linked  to  mainframes.  The 
microcomputers  were  placed  in  selected  audit  sites.  Recipients  of  the  microcomputers 
were  not  given  special  training  prior  to  receiving  the  machines,  and  headquarters 
guidance  concentrated  on  safeguarding  the  hardware  and  software  assets.  Currently, 
Naval  Audit  Service  has  no  standard  applications  for  use  of  the  microcomputers  and 
the  auditors  are  left  to  develop  applications  on  their  own. 

C.  SCOPE 

The  objective  of  this  thesis  is  to  demonstrate  how  microcomputers  can  be  used 
by  auditors  and  audit  managers  in  their  daily  operations.  The  Naval  Audit  Service 
wants  its.  auditors  and  audit  managers  to  utilize  the  microcomputers  fully. 
Headquarters  personnel  are  concerned  that  the  microcomputers  will  be  used  only  as 
word  processors  and  on  data  processing  audits.  How  to  use  microcomputers  on  all 
types  of  audits,  covering  all  functional  areas,  is  the  primary  concern  of  Headquarters 
personnel  and  this  thesis. 

To  accomplish  the  objective,  research  concentrated  on  how  ordinary  audit 
practices  and  procedures  can  be  performed  on  microcomputers.  The  procedures  and 
practices  considered  are  performed  on  all  audits.  While  the  research  and 
recommendations  of  this  thesis  are  aimed  at  the  Naval  Audit  Service,  any  audit 
organization  can  apply  the  findings  of  this  research  to  its  use  of  microcomputers. 

There  were  several  areas  concerning  microcomputers  and  their  use  that  were  not 
considered.  These  included  microcomputer  security,  hardware  configurations, 
microcomputer  to  mainframe  communication,  acquisition  methods  and  training 
methods.  All  these  areas  are  important  and  should  be  considered  by  audit 
organizations  before  purchasing  microcomputers.  However,  each  one  of  these  areas 
could  be  a  separate  topic  for  research. 

D.  METHODOLOGY 

This  thesis  research  was  conducted  within  the  framework  of  current 
microcomputer  practices.  Data  were  gathered  from  current  accounting  and  computer 
literature,  public  accounting  firms,  private  industry,  federal  government  agencies  and 
the  Naval  Audit  Service.  Data  gathering  techniques  included  surveys,  interviews, 
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attendance  at  a  Naval  Audit  Service  management  conference,  software  reviews, 
workload  analysis  and  a  literature  review. 

The  process  for  introducing  microcomputers  into  audit  organizations  is  discussed 
in  Chapter  2.  Introducing  microcomputers  into  an  audit  organization  can  affect  the 
balance  and  performance  of  the  organization.  The  policies,  procedures  and  people 
required  for  smooth  transition  to  the  new  technology  are  considered  in  this  chapter. 
The  policies  and  procedures  for  introducing  microcomputers  were  determined  from 
current  literature  on  introducing  change  into  organizations.  Also,  interviews  with 
personnel  from  the  Naval  Audit  Service  and  other  audit  organizations  disclosed  some 
methods  and  problems  that  should  be  considered.  Naval  Audit  Service  workload  was 
analyzed  for  areas  in  which  microcomputers  could  be  quickly  assimilated  into  the  audit 
process.  Finally,  this  chapter  looks  at  alternatives,  for  distributing  information 
concerning  microcomputers  to  the  audit  staff.  In  keeping  with  the  objectives  of  the 
thesis,  the  methods  evaluated  can  be  used  by  all  auditors  for  all  types  of  audits. 

A  significant  portion  of  the  research  was  in  the  area  of  software  demonstrations. 
Different  types  of  software  were  obtained  from  commercial  vendors,  the  public  domain 
and  federal  agencies.  The  software  capabilities  were  examined  through  live  program 
testing  and  reviewing  of  the  software  documentation.  In  addition,  the  software  was 
tested  for  it's  usefulness  in  performing  typical  audit  and  administrative  tasks.  These 
tasks  included  both  common  audit  tasks  and  ones  unique  to  the  Naval  Audit  Service. 
Where  possible,  actual  audit  applications  were  developed  to  test  the  software.  Chapter 
3  contains  the  results  of  our  software  revietv  and  recommendations  for  audit 
applications. 

A  survey  was  conducted  on  the  use  of  microcomputers  by  auditors  and  audit 
managers.  Participants  in  the  survey  included  public  accounting  firms,  private  industry 
and  federal  government  audit  organizations.  The  extent  of  microcomputer  use  by 
auditors  in  other  organizations  was  determined  by  this  survey.  A  separate  survey  was 
sent  to  Naval  Audit  Service  users  of  microcomputers.  This  survey  provided  an 
indication  of  how  microcomputers  are  presently  used  in  the  Naval  Audit  Service.  Also, 
it  supplied  information  on  the  needs  and  problems  facing  Naval  Audit  Service  users. 
The  results  of  these  surveys  and  the  conclusions  drawn  from  them  are  contained  in 
Chapter  4. 

The  results  of  this  research  are  summarized  in  Chapter  5.  Also,  this  chapter 
contains  recommendations  for  using  microcomputers  in  the  Naval  Audit  Service.  The 
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potential  benefits  of  using  microcomputers  for  auditing  and  audit  management  are 
great.  These  benefits  include  increased  productivity,  the  ability  to  sample  more  data, 
increased  standardization  of  the  audit  process,  increased  timeliness  and  accuracy  of 
audit  results,  and  better  utilization  of  audit  resources.  The  recommendations  included 
in  this  chapter  do  not  pretend  to  be  a  comprehensive  list.  Also,  some  of  the  benefits 
listed  above  might  be  achieved  in  ways  other  than  those  discussed  in  this  thesis. 
However,  it  is  felt  that  the  implementation  of  the  recommendations  contained  in  this 
thesis  will  improve  the  Naval  Audit  Service's  use  of  microcomputers  and  the  efficiency 
of  the  organization  s  a  whole. 


17 
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A.  INTRODUCTION 

There  are  several  areas  an  audit  organization  should  consider  before  introducing 
microcomputers  into  its  operations.  Introducing  any  change  into  an  organization  will 
have  an  effect.  Whether  this  effect  is  good  or  bad  will  depend  upon  how  the  change  is 
planned,  implemented  and  managed.  In  order  for  Naval  Audit  Service  to  integrate 
microcomputers  smoothly  into  its  organization  these  factors  should  be  considered. 

The  integration  of  microcomputers  into  the  Naval  Audit  Service  will  be  a 
complex  process.  The  decentralized  organizational  structure  makes  it  difficult  to 
monitor  implementation  and  usage  of  microcomputers.  Many  of  the  audit  sites  are 
geographically  separated  from  both  regional  offices  and  Naval  Audit  Service 
Headquarters.  Thus,  it  is  important  that  policies  and  procedures  for  microcomputer 
use  are  clear,  documented,  and  understood  by  Audit  Service  personnel.  Also,  a  method 
for  distributing  information  about  changes  in  policy,  methods  and  developments  in 
both  hardware  and  software  is  needed.  The  framework  for  information  distribution  is 
already  in  place  in  the  Naval  Audit  Service.  How  the  microcomputers  can  be  used  in 
the  audit  process  is  another  area  that  must  be  addressed  for  successful  integration  to 
occur.  Pertinent  questions  include  on  which  audits  microcomputers  should  be  used, 
what  applications  are  needed  and  how  these  applications  should  be  distributed 
throughout  the  organization.  Finally,  there  are  both  physical  and  institutional 
constraints  placed  on  microcomputer  use  in  the  audit  process.  These  constraints  must 
be  identified  and  dealt  with  in  order  for  successful  integration  of  microcomputers  into 
the  Naval  Audit  Service.  Alternatives  available  to  the  Naval  Audit  Service  are 
discussed  in  this  chapter. 

B.  WAYS  TO  INTEGRATE  MICROCOMPUTERS  INTO  THE 

ORGANIZATION 

It  has  been  suggested  that  implementation  of  computer  systems  is  equivalent  to 
managing  change  within  the  organization  [Ref.  2:  p.  189],  Two  basic  forces  exist  that 
cause  organizations  to  change-external  forces  and  internal  forces.  External  forces  for 
change  include  (l)  increasing  workloads,  (2)  increasing  costs,  (3)  changing  technology. 
(4)  changing  perceptions  of  the  beneficiaries  of  an  organization's  efforts.  (3)  changing 
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perceptions  of  appropriate  behavior,  and  (6)  others.  Internal  forces  for  change  include 
(1)  different  organizational  attitudes,  (2)  problems  encountered  in  implementing  new 
technology,  (3)  different  strategies,  (4)  decrease  in  the  number  of  members  in  the 
organization,  (5)  the  resulting  decrease  in  the  experience  level  of  the  organization  s 
members,  (6)  increasing  workloads  and  work  backlogs,  (7)  and  dissatisfaction  among 
organization  members.  [Ref.  3:  pp.  379-3801 

Management  theories  and  studies  about  change  in  organizations  recommend  two 
major  approaches.  These  two  approaches  to  change  are  either  piecemeal  response  to 
change  as  it  occurs  or  programmed  change  as  a  natural  evolution  of  the  organization. 
[Ref.  3:  p.  380]  The  piecemeal  approach  is  satisfactory  for  minor  change.  But  the 
planned  program  approach  is  mandatory  for  successful  major  changes  in  an 
organization.  The  planned  program  approach  is  defined  as  ” .  . .  the  deliberate  design 
and  implementation  of  a  structural  innovation,  a  new  policy  or  goal,  or  a  change  in 
operating  philosophy,  climate,  and  style."  [Ref.  4:  p.  209] 

C.  PROCESS  AND  PROBLEMS  OF  INTRODUCING  MICROCOMPUTERS 
Strategic  change  refers  to  non-routine,  non-incremental,  and  discontinuous 
change  which  alters  the  overall  orientation  of  the  organization  and/or  the  components 
of  the  organization.  [Ref.  5:  p.  17]  Introducing  microcomputers  into  Naval  Audit 
Service  is  an  example  of  a  strategic  change.  The  volume  of  microcomputers  purchased 
is  significant  and  these  machines  provide  users  with  a  completely  different  audit  tool 
than  the  tools  used  in  the  past.  Thus,  the  ways  in  which  audit  and  audit  management 
tasks  were  previously  performed  are  also  changing  with  the  introduction  of  this  new 
audit  tool.  Naval  Audit  Service  must  manage  this  change.  Managing  change  attempts 
to  reduce  the  uncertainty  associated  with  it.  Presently,  microcomputer  users  are 
uncomfortable  with  these  machines  and  uncertain  as  to  how  to  use  them  fully.  In 
order  to  manage  the  change  process  successfully,  three  views  of  the  change  should  be 
considered.  These  are  the  technical,  political,  and  cultural  views.  Although 
introducing  microcomputers  is  obviously  a  technical  change,  the  other  views  are  also 
necessary.  A  change  in  technology  can  impact  the  political  and  cultural  aspects  of  an 
organization.  The  potential  impact  must  be  considered  in  order  for  the  organization  to 
effect  the  change  smoothly.  Successful  change  management  involves  three  ingredients. 
These  are  (1)  a  diagnostic  capability  to  probe  potential  future  courses  of  action  and 
determine  the  current  state  of  the  organizational  and  managerial  affairs,  (2)  a  capacity 


for  developing  change  strategies  and  selecting  the  appropriate  organization  and 
management  techniques  for  carrying  out  the  strategy,  and  (3)  a  cluster  of  skills  and 
competencies  required  to  implement  and  carry  through  the  efTort.  [Ref.  5:  pp.  20-2 1J 
The  change  process  includes  identifying  intervention  points,  selecting  intervention 
techniques,  identifying  conditions  for  success,  developing  an  evaluation  plan  and 
developing  a  specific  implementation  plan. 

The  first  ingredient  of  successful  change  management,  diagnostic  capability,  will 
not  be  discussed  here.  The  Naval  Audit  Service  has  already  embarked  on  a  change 
process.  Therefore  we  will  concentrate  on  developing  the  change  strategy  and  how 
best  to  implement  it.  Change  strategy  is  comprised  of  a  change  plan,  appropriate 
change  techniques,  and  the  implementation  process.  The  change  plan  is  a  general  plan 
developed  to  tell  what  in  the  organization  needs  changing.  It  does  not  include  how  the 
change  should  be  accomplished.  This  is  covered  in  the  implementation  plan.  The 
purpose  of  the  change  strategy  is  develop  the  desired  future  organizational  state.  The 
change  strategy  is  similiar  to  the  life-cycle  management  concept  used  in  management  of 
large  projects  in  the  Navy.  In  life-cycle  management,  the  future  state  is  developed  in 
the  mission  analysis  and  program  initiation  phase.  The  techniques  and  methods  for 
implementing  the  change  correspond  to  events  that  occur  in  the  concept  development 
and  definition  design  phases  of  life-cycle  management.  Then  actual  implementation 
and  evaluation  of  the  change  strategy  are  similar .  to  events  that  occur  in  the 
deployment  operation  phase  of  the  life-cycle  management  process. 

The  future  desired  state  of  the  organization  should  consider  the  technical, 
political  and  cultural  systems  of  the  organization.  These  three  systems  must  be  in 
alignment  for  the  change  to  be  effective  and  the  organization  to  operate  smoothly. 
This  is  because  these  systems  are  not  completely  independent  of  each  other.  They  are 
loosely  coupled  and  a  change  in  one  of  the  systems  could  affect  others.  [Ref.  6:  pp. 
1-19]  In  order  to  develop  a  picture  of  the  desired  state,  the  organization  should  develop 
a  statement  of  the  types  of  changes  needed  in  these  three  organizational  systems.  This 
statement  should  be  in  general  terms.  In  addition  to  the  general  change  statement  a 
detailed  description  of  the  specific  changes  required  in  the  various  organizational 
components  is  needed.  This  includes  changes  in  policy,  procedures,  management  style, 
organizational  networks,  people  and  tools. 

A  change  strategy  alters  the  information  processing  capacity  of  the  organization. 
[Ref.  5:  p.  203]  Technical  change  strategies  involve  changing  organization  components 


to  deal  with  uncertainty  created  by  changing  environment,  technological  developments 
or  changing  tasks.  The  organizational  components  include  mission  and  strategy,  tasks, 
organizational  networks,  people  and  processes.  Each  of  these  components  should  be 
reviewed  to  determine  the  amount  of  change  needed  to  reach  the  desired  future  state. 

The  Naval  Audit  Service  is  facing  technological  change  as  the  result  of  a  new 
technological  development-using  microcomputers  for  auditing.  This  change  requires 
adjustments  in  the  tasks,  people,  processes  and  organizational  network  components. 
The  task  change  required  is  the  development  of  a  long  range  plan  which  identifies  the 
future  state  of  the  organization.  The  organizational  network  component  is  comprised 
of  both  the  formal  organizational  structure  and  the  informal  networks  developed  by 
employees.  Naval  Audit  Service  organizational  structure  is  not  greatly  affected  by  the 
introduction  of  microcomputers.  The  microcomputer  is  a  tool  for  performing  audits 
and  does  not  affect  workload  types  and  sources  of  workload.  Therefore,  the 
distribution  of  auditors  and  audit  sites  should  not  be  affected  by  introduction  of  the 
microcomputers.  However,  using  microcomputer  technology  does  require  an  increase 
in  technical  support  provided  to  auditors.  The  Naval  Audit  Service  user  community  is 
trained  as  accountants  and  in  most  instances  does  not  have  prior  experience  in  using 
microcomputers.  Microcomputers  are  not  difficult  to  learn  to  use  but  can  be  time 
consuming  and  frustrating.  The  Naval  Audit  Service  is  concerned  with  usage  rates. 
Technical  support  w’ould  provide  users  with  answers  to  their  questions  and  provide  the 
auditor  with  a  more  positive  feeling  concerning  microcomputer  use.  The  framework 
for  this  technical  support  is  already  established  within  the  Audit  Service.  Each  region 
has  an  automated  systems  administrator.  Currently  this  is  the  point  of  contact  for 
questions  concerning  the  microcomputer.  However,  this  position  is  more  concerned 
with  protection  of  the  assets  than  with  providing  guidance  and  solving  problems  related 
to  the  microcomputers.  In  addition,  this  position  often  is  considered  to  be  a  collateral 
duty  rather  than  a  full-time  job.  Also,  support  is  available  from  Naval  Audit  Service 
Headquarters.  Again,  this  support  is  collateral  support  rather  than  full-time  support. 
The  Air  Force  Audit  Agency's  Small  Computer  Technical  Center  is  one  example  of  a 
microcomputer  support  organization. 

Altering  the  organizational  structure  is  probably  the  technical  change  strategy 
most  often  used.  One  way  to  alter  the  organizational  structure  is  through  the  use  of 
integrating  mechanisms.  Integrating  mechanisms  help  the  organization  achieve 
coordination  and  control  over  its  tasks  and  people.  These  mechanisms  vary  in  both 
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cost  and  complexity.  The  goal  of  integrating  mechanisms  is  to  match  simple  low  cost 
mechanisms  with  situations  having  low  uncertainty  and  save  the  complex  high  cost 
mechanisms  for  high  uncertainty  cases.  Galbraith  categorized  integrating  mechanisms 
as  simple  measures  (e.g.  rules,  hierarchy  of  authority),  devices  which  decrease  the  need 
for  information  processing  (e.g.  creation  of  slack  resources,  creation  of  self-contained 
units),  or  complex  mechanisms  for  increasing  information  processing  capacity  (e.g. 
vertical  information  processing  systems  and  input-oriented  relationships).  [Ref.  7]  The 
difficulty  of  implementing  these  mechanisms  increases  as  one  proceeds  from  simple  to 
complex  mechanisms. 

Another  method  of  technical  change  strategy  is  changing  the  people  within  the 
organization.  This  is  accomplished  either  through  the  recruiting  process  or  training 
and  developing  existing  employees.  Hiring  people  who  possess  the  necessary  skills  is 
the  quickest  and  most  effective  means  of  effecting  the  change.  However,  this  option  is 
not  fully  available  to  the  Naval  Audit  Service.  The  hiring  process  is  constrained  by  the 
number  of  vacancies  in  the  organization  and  the  Office  of  Personnel  Management 
personnel  rules.  Such  factors  as  ceiling  points,  job  classifications,  and  personnel 
registers  limit  the  number  of  people  who  can  be  hired.  Developing  the  skills  of  existing 
employees  is  a  better  option  for  the  Naval  Audit  Service.  The  Naval  Audit  Service  has 
a  number  of  training  courses  available  for  its  employees.  Some  of  these  are  mandatory 
classes  that  are  required  at  various  points  during  every  auditor's  career,  while  the 
remaining  training  classes  are  selected  by  the  auditors  for  their  own  career 
development.  Development  and  inclusion  of  training  classes  in  various  aspects  of 
microcomputer  technology  and  use  should  be  considered  by  the  Naval  Audit  Service. 
These  courses  could  be  split  between  mandatory  and  optional  ones.  These  courses 
would  expose  the  auditors  to  the  new  technology  and  provide  a  base  to  build  on. 

Once  the  strategic  change  plan  is  developed  then  the  organization  must  determine 
what  to  change  first  and  how  to  effect  the  change.  There  are  several  alternative 
locations  within  the  organization  where  the  change  can  be  initiated.  Among  these 
choices  are  top  management  only,  organizational  components  that  want  the  change  the 
most,  the  components  that  need  the  change  the  most  and  new  components  created  for 
the  technology.  Which  of  these  is  chosen  is  top  management's  decision. 

After  the  starting  point  for  the  change  is  selected  management  must  select  the 
change  approach.  These  are  specific  processes  and  procedures  for  changing  the 
organizational  behavior.  [Ref.  5:  p.  292J  Current  change  technologies  include  open 
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systems  planning,  job  design  technologies,  organizational  design  technologies,  team 
development,  quality  control  circles,  and  career  development.  A  combination  of  these 
various  technologies  appears  to  be  the  best  way  to  integrate  microcomputers  into  the 
Naval  Audit  Service.  Some  open  systems  planning  is  needed  to  define  the  future 
demands  on  and  responses  to  microcomputer  technology  in  the  Naval  Audit  Service. 
Open  systems  planning  involves  defining  the  organizational  mission  and  identifying 
current  and  future  factors  that  could  affect  the  organization  s  ability  to  carry  out  the 
mission.  These  factors  occur  both  inside  and  outside  the  organization.  Based  on  this 
analysis,  methods  can  be  developed  to  alter  or  control  these  factors. 

Obviously  the  job  design  technologies  are  needed  to  change  how  audit  tasks  are 
performed.  The  microcomputer  is  a  potentially  powerful  audit  tool  that  eventually  will 
change  the  productivity  of  audit  work  and  the  way  in  which  audits  are  performed.  The 
Naval  Audit  Service  needs  to  develop  procedures  and  policies  for  altering  the 
traditional  audit  work  procedures  to  take  advantage  of  the  microcomputer.  However, 
this  work  process  redesign  should  be  accomplished  in  conjunction  with  the  upgrading 
of  the  auditor's  microcomputer  skills. 

As  previously  discussed,  the  various  organizational  design  technologies  should  be 
used  to  integrate  the  microcomputers  into  the  audit  prodess.  These  procedures  include 
developing  technical  support  groups  at  both  regional  and  headquarters  level, 
establishing  rules  and  procedures  for  microcomputer  use,  and  developing  a 
microcomputer  newsletter  for  the  Audit  Service  as  a  whole.  The  technology  used  for 
integrating  microcomputers,  whatever  it  may  be,  should  be  documented  and  announced 
so  that  users  understand  it. 

Team  development  technology  affects  both  organizational  processes  and  people. 
Team  development  is  based  on  the  action-research  approach  to  change.  This  approach 
involves  the  orderly  collection  of  data  on  organizational  problems  and  the  use  of  the 
data  for  solving  these  problems.  The  data  collection  and  feedback  occur  on  an  on¬ 
going  basis  so  that  organizational  members  can  make  changes,  evaluate  the  outcomes 
of  the  changes,  and  make  new  changes.  The  objective  of  team  developemnt  is  to 
provide  the  team  members  with  the  knowledge  and  skills  to  allocate  workload,  adapt 
the  work  process,  and  facilitate  decision  making,  problem  solving,  and 
communications. 

Quality  control  circles  are  a  recent  change  technology.  Groups  of  employees  are 
brought  together  periodically  to  come  up  with  solutions  to  organizational  problems. 
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The  proposed  solutions  are  then  communicated  to  management  for  their  consideration 
and  action.  The  Naval  Audit  Service  uses  this  technology  during  the  annual  'all- 
hands'  conferences  held  by  each  region.  Also,  the  quarterly  directors  conferences  use 
quality  control  circles  to  air  organizational  problems  and  issues.  However,  these 
meetings  are  not  conducted  frequently  enough  to  be  of  much  benefit  in  integrating 
microcomputers  into  the  Naval  Audit  Service. 

The  change  technology  to  use  depends  upon  several  factors.  The  first  factor  is 
the  identification  of  which  organizational  component  needs  changing.  Some  change 
technologies  are  better  suited  for  a  particular  component  than  others.  The 
organization  should  understand  the  change  technology  chosen.  What  the  technology 
does,  how  it  does  it  and  the  underlying  assumptions  must  be  understood.  Also,  some 
form  of  cost,  benefit  analysis  should  be  performed  before  the  technology  is  selected. 
Other  factors  to  consider  before  selecting  the  technology  include  the  depth  of  the 
needed  change  (individuals  versus  processes)  and  the  conditions  needed  for  the 
technology  to  work.  After  the  specific  change  technology  is  selected  the 
implementation  plan  is  developed.  The  plan  should  include  the  participants,  the 
manager  of  the  change,  a  time  table  for  activities,  and  the  resources  needed. 

The  organization  goes  through  a  transition  period  while  moving  to  the  desired 
state.  Effective  management  of  the  transition  is  needed  for  successful  implementation 
of  the  change.  Management  should  define  the  transition  state  as  separate  from  the 
present  or  future  state,  determine  the  most  effective  form  of  management,  set  up  this 
management  structure  and  communicate  this  structure  to  the  organization.  [Ref.  8:  pp. 
48-49]  This  structure  could  be  a  project  manager,  existing  hierarchy,  a  group  of 
influential  leaders,  or  a  group  of  people  from  different  levels  and  departments  in  the 
organization.  The  transition  manager  uses  the  implementation  plan  to  manage  the 
change. 

Even  though  the  forces  that  cause  change  are  numerous,  powerful  resistance  to 
change  exists  in  all  organizations.  For  every  proposed  change,  there  are,  invariably, 
forces  that  encourage  maintenance  of  the  status  quo.  There  are  many  reasons  for 
resistance  to  change.  A  few  of  these  reasons  are  (1)  socio-political  losses  of  authority, 
power  and  corporate  territory,  (2)  perceived,  potential  job  loss,  (3)  fear  of  new  things, 
including  fear  of  learning  to  use  computers  and  fear  of  computers  themselves,  and  (4) 
structural  inertia  within  the  organization  (i.e.,  that's  the  way  it's  always  been  done!). 


The  change  process  must  be  monitored  and  evaluated  during  it's  execution.  The 
purpose  of  the  monitoring  and  evaluation  is  to  determine  if  the  change  effort  is 
worthwhile,  has  resulted  in  the  desired  changes,  and  is  preventing  the  new  state  from 
slipping  back  into  the  old.  These  issues  should  be  addressed  when  the  change  plan  is 
developed.  The  change  management  must  develop  some  form  of  measuring  these 
issues  for  the  evaluation  to  be  meaningful.  The  people  involved  in  the  change  must 
understand  the  the  evaluation  process  and  the  measures  being  used.  Some  Naval 
Audit  Service  managers  are  already  concerned  about  the  ill  effects  of  measuring 
productivity  from  microcomputer  use  when  the  majority  of  users  are  untrained  in 
exploiting  the  benefits  of  the  microcomputer.  A  good  evaluation  plan  will  provide 
change  managers  with  information  about  the  change  progress.  This  will  result  in  a 
better  managed  change. 

Overcoming  resistance  to  change  requires  a  strategy  that  overcomes  the 
resistance  and  implements  the  planned  change.  Empirical  studies  have  found  that  the 
following  factors  substantially  impact  the  success  of  computer  implementations: 

•  Support  from  top  management 

•  Clear  perception  of  a  need 

•  A  definite  problem  to  solve 

•  Early  user  commitment  and  staff  support  [Ref.  2:  p.  196] 

Practitioners  have  lent  practical  credence  to  the  findings  of  the  empiricists.  David 
Freedman,  a  practitioner  writing  about  his  own  experiences,  relates  that 
microcomputer  introduction  and  subsequent,  successful  integration  into  the  audit 
organization  depends  on  the  cooperation  of  key  personnel,  not  only  from  top 
management  but  from  all  of  the  levels  in  the  organization  where  microcomputers  will 
be  approved  and  used.  The  integration  effort  should  be  a  team  effort.  Involvement  in 
this  team  effort  must  begin  at  the  top  levels  of  management.  The  top  management 
should  be  involved  for  two  reasons.  First,  the  organization  needs  top  management's 
approval  to  obtain  microcomputer  resources.  Fortunately  in  the  case  of  the  Naval 
Audit  Service,  the  microcomputer  resources  are  already  available.  Second,  top 
management's  involvement  is  required  in  order  to  set  and  maintain  an  organizational 
attitude  that  is  conducive  to  using  microcomputer  resources  to  their  fullest  capacity 
and  that  is  conducive  to  maintaining  the  resource  at  the  highest  level  of  the  current 
technology,  consistent  with  budget  limitations  and  the  mission  needs  of  the  Naval 
Audit  Service.  From  top  management,  involvement  in  the  integration  team  effort 
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should  follow  through  the  audit  managers  to  the  auditors,  who  are  intended  to  be  the 
primary  users  of  this  new  audit  tool.  If  they  are  included  in  the  integration  of  the 
microcomputer,  they  will  feel  that  they  had  an  important  voice  in  the  selection  and  use 
of  their  own  audit  tools  and  thus  should  be  more  receptive  to  actually  using  the 
microcomputer,  instead  of  letting  it  sit  unused.  A  representative  of  the  Data  Processing 
(or  Management  Information  System)  department  is  also  an  appropriate  participant; 
he  or  she  can  lend  unique  technical  expertise  and  advice-if  the  chosen  Data  Processing 
representative  can  relate  to  the  team  and  use  minimal  computer  jargon.  [Ref.  9] 

The  clear  perception  of  the  need  for  microcomputers  by  those  holding  budget 
and  contract  authority  in  the  Naval  Audit  Service  is  obvious  from  the  level  of  Naval 
Audit  Service  procurement  of  microcomputers.  However,  the  perceived  need  for  these 
microcomputers  by  the  intended  users  may  not  be  universal  throughout  the  Naval 
Audit  Service.  If  the  need  perception  is  not  universal,  then  microcomputer  use  might 
not  be  universal.  Unused  microcomputers  are  wasted  resources. 

Problem  solving,  in  a  team  setting,  provides  an  opportunity  to  break  down 
resistance  to  the  change  to  microcomputers.  Teamwork  involves  users  in  decisions. 
Negotiation  and  listening  provide  a  forum  in  which  organization  members  may  express 
fears  and  be  assured  that  these  fears  are  unfounded  (or,  confirm  that  their  fears  will 
become  reality  and  develop  mechanisms  to  cope  with  the  forthcoming  reality).  [Ref.  9] 
Conscious  involvement  by  top  management  (and  top  management  staff)  can  help 
break  down  resistance  to  change  by  providing  an  authoritative  channel  of 
communication  where  user  feedback  can  be  seriously  considered  so  that  microcomputer 
introduction  is  performed  in  ways  that  allay  fears,  make  audit  tasks  easier,  and  increase 
job  efficiency.  [Ref.  9j 

D.  CHANGES  AS  THE  RESULT  OF  USING  MICROCOMPUTERS 
1.  Effects  of  Introducing  Microcomputers 

The  introduction  of  microcomputers  is  potentially  the  single,  most  significant 
office  productivity  development  since  the  typewriter. 

Microcomputers  have  the  capacity  and  sophistication  necessarv  to  perform  tasks 
that  previously  either  required  tne  power  of  much  larger  computers  or  simplv 
coula  not  be  accomplished  economically  by  a  computer  of  anv  size.  Micros  can 
be  used  effectively  in  a  matter  of  hours  by  individuals  possessing  little  or  no 
computer  training  ....  [Ref.  10:  p.  1) 
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Microcomputers  or,  more  accurately,  microcomputer  software  can  lessen  the 
reliance  on  pen  and  paper  in  the  oftice  environment.  The  microcomputer  is  automating 
the  desktop,  like  machinery  automated  the  factory. 


Executives  and  managers  as  all  levels  increasingly  use  microcomputers  to  prepare 
budgets  and  forecasts  and  complete  other  time-consuming  tasks  that  were 
previously  performed  manually.  Microcomputers  are  now  routinely  used  to 
prepare  financial  statements,  compile  . . .  statistics,  maintain  records  and  perform 
word  processing.  In  short,  the  microcomputer  promises  to  automate  the  desktops 
of  office  workers,  eliminating  much  of  the  need  for  pencils,  paper  and  adding 
machines  ....  (&ef.  10:  p.  if 


Some  individuals  would  argue  that  oftice  automation,  and  microcomputers  in 
particular,  are  nothing  more  than  today's  continuing  aspect  of  the  industrial  revolution 
that  began  with  the  mechanization  of  hand-manufacturing  processes  and  that 
automation  is  merely  the  sophisticated  extension  of  factory  mechanization  into  the 
office.  [Ref.  11:  Abstract]  However,  along  with  the  introduction  of  the  microcomputer, 
introduction  of  different  methods  of  internal  control  are  needed.  The  introduction  of 
microcomputers  into  an  audit  organization  does  not  lessen  the  need  for  the  people  of 
that  organization  to  conduct  audits  in  accordance  with  generally  accepted  auditing 
standards  and  government  auditing  standards.  Nor  does  the  introduction  of 
microcomputers  lessen  the  need  for  auditor  judgement.  On  the  contrary,  the  auditor 
using  the  microcomputer  as  an  audit  tool  must  know  the  capabilities  and  limitations  of 
the  tool.  The  auditor  must  also  understand  and  correctly  interpret  the  output  generated 
by  the  microcomputer  in  terms  of  the  context  of  audit  findings  and  intended  audit 
objectives.  The  potential  for  incorrect  results  from  the  microcomputer  is  as 
correspondingly  great  as  the  potential  for  increased  efficiency  and  accuracy. 

Microcomputer  users  report  less  segregation  of  duties  because  one  person 
commonly  performs  the  functions  or  user,  programmer,  systems  analyst  and 
computer  operator.  Another  area  of  concern  is  the  casual  operating 
environment . .  .  this  contrasts  sharplv  with  the  mainframe  environment” 
Controls  over  program  changes,  system  documentation,  backup  and  recovery 
plans,  data  approval,  validation  checks,  and  systems  testing  still  need  to  be 
implemented  in  many  microcomputer  applications  .  . .  .Questions  most  frequently 
asked  are 


•  Is  microcomputer  technology  a  passing  fad? 

•  Does  everyone  in  the  organization  need  a  microcomputer? 

•  Can  microcomputers  really  be  used  effectively  by  employees? 

•  Are  detailed  management  policies  and  centralized  controls  necessary? 
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•  How  do  microcomputer  systems  interact  with  other  computer  systems? 

•  Are  data  security  and  data  integrity  real  issues? 

•  Is  everyone  in  the  organization  using  the  same  (consistent  and  up-to-date)  data? 

•  Are  we  getting  the  most  for  our  money  from  these  machines?  (Ref.  10:  p.  2] 

With  1984  projections  of  2.8  million  microcomputers  in  offices,  it  is  a  certainty  that 
microcomputers  are  not  a  passing  fad  [Ref.  10:  p.  1].  Each  organization  must  decide 
for  itself  whether  or  not  each  individual  should  have  his  or  her  own  microcomputer. 
This  and  the  next  chapter,  will  attempt  to  demonstrate,  by  using  specific  examples  and 
programs,  that  microcomputers  can  indeed  be  used  effectively  by  the  employees  of  the 
Naval  Audit  Service.  The  necessity  of  detailed  management  policies  and  controls  will 
be  discussed  further  in  the  succeeding  pages  of  this  chapter.  Microcomputer  systems 
interaction  with  other  computer  systems  (i.e.,  mainframe  systems)  is  beyond  the  stated 
scope- of  this  thesis.  Therefore,  no  attempt  will  be  made,  to  answer  the  last  two 
questions  relating  to  data  consistency  and  return  on  investment.  Rather,  attributes  that 
may  be  used  to  answer  these  last  two  questions  will  be  identified. 

2.  Benefits  of  Introducing  Microcomputers 

Clerical  staffs,  including  auditors,  have  been  the  last  areas  cf  industry  and 
government  to  receive  mechanization  and  automation.  Until  recently,  clerical  staffs 
have  been  a  small  part  of  organizations  (government  excepted)  and  the  cost  of  clerical 
inefficiency  has  been  easily  absorbed  in  the  greater  sum  of  the  organization.  As  clerical 
staffs  continue  to  grow  in  terms  of  numbers  and  salaries,  clerical  inefficiency  becomes 
harder  for  the  organization  to  absorb.  Inefficiency  in  the  office  environment  is 
sometimes  difficult  to  measure.  Much  of  the  auditor's  work  is  judgemental,  heuristic, 
subjective,  and  dependent  upon  the  auditor's  experience.  In  addition,  each  audit  may 
be  different  from  the  last  and  may  require  unique  actions.  These  actions  may  be 
difficult  to  standardize  or  repeat  over  several  audits  when  those  audits  are  conducted 
under  dissimilar  requirements  and  constraints. 

Inefficiency  in  the  office  is  not  alwavs  obvious.  Much  of  the  waste  and 
inefficiency  in  clerical  procedures  is  hidden.  It  is  seldom  as  perceptible  or 
dramatic  as  the  scrap  pile  or  the  shutdown  machine.  Neither  casual  observation 
nor  normal  accounting  reports  make  it  obvious.  [Ref.  12:  p.  3] 

Clerical  inefficiency  must  be  eliminated,  and  the  microcomputer  offers  possibilities  for 
cost  reduction  and  efficiency  increases.  However,  automation  is  not  a  cure-all  for 
office  or  auditor  inefficiency,  but  some  of  its  benefits  are  as  follows: 
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•  Increased  efficiency  -  this  does  not  mean  100%  efficiency! 

•  Improved  methods  of  operating  in  the  field  and  at  the  central  office 

•  Reduced  physical  effort  and  improved  work  environment 

•  Enhanced  quality  of  audits  and  reduced  risk  of  overlooking  material  items 

•  Increased  capacity  and  thus  better  ability  to  keep  up  with  external  demands  for 
more  audit  work 

•  Pride  in  owning  the  latest,  state-of-the-art  auditing  tools  [Ref.  11:  pp.  83-84] 

3.  People  and  Resource  Policies 

a.  Planning  for  the  Introduction  and  Use  of  Microcomputers 

Planning  for  the  introduction  and  use  of  microcomputers  should  be  done  to 
prevent  excess  equipment  and  incompatible  hardware  and  software.  Such  uncontrolled 
proliferation  could  harm  the  organization's  microcomputer  system  compatiblility  and 
ability  to  exchange  data  and  programs  across  microcomputers.  Management  planning 
for  microcomputer  systems  should  at  least  address  these  areas: 

•  Which  micro/ software  combination^)  best  meet  user  needs? 

•  How  is  maintenance  for  microcomputers  and  related  peripheral  equipment 
going  to  be  provided? 

•  How  will  user  training  be  provided? 

•  Should  relatively  expensive  peripheral  equipment  be  shared? 

•  Should  microcomputers  have  the  ability  to  communicate  with  one  another? 

•  Have  data  security  issues  been  considered? 

•  Should  microcomputers  be  allowed  to  access  larger  computers  within  the 
organizations? 

•  How  can  new  technological  advances  be  anticipated?  [Ref.  10:  pp.  20-21] 

When  developing  plans  for  microcomputers,  the  following  aspects  are 
pertinent  considerations: 

•  User  requirements  for  information  processing. 

•  The  priority  of  the  identified  information  processing  requirements. 

•  Hardware  and  software  that  will  meet  information  processing  requirements. 

•  Timetable  for  introduction  and  implementation  of  microcomputer  systems  and 
applications. 

•  Future  information  processing  requirements. 

•  Management  policies  necessarv  to  ensure  that  microcomputers  are  utilized 
effectively  and  information  is  safeguarded  adequately.  [Ref.  10:  p.  21] 
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b.  Management  Policies  and  Guidance  to  the  Organization 

The  microcomputer  is  an  individual  productivity  tool.  As  such,  it  can  allow 
the  individual  user  a  certain  degree  of  enhanced  creativity  and  application  of  initiative. 
Yet  from  another  aspect,  today's  powerful  microcomputers  are  capable  of  affecting  the 
data,  procedures,  and  operations  of  the  entire  organization.  From  these  perspectives 
then,  management  policies  toward  the  microcomputer  systems  should  attempt  to  strike 
a  balance  between  the  individual's  creative  need,  which  is  healthy  for  the  organization, 
and  the  organization's  need  to  control  its  own  processes. 


Although  it  is  true  that  much  of  the  office  work  being  performed  today  with 
microcomputers  is  similar  to  that  previously  done  manuallv,  the  technology 
presents  risks  not  found  in  more  traditional  manual  environments.  Micros  can 
process  information  significantly  faster  than  can  humans  and  are  capable  of 
storing  tremendous  volumes  of  data,  making  it  much  easier  to  modify,  destrov,  or 
remove  sensitive  data.  More  importantly,  microcomputer  systems  often  evolve  to 
encompass  more  complex  applications,  such  as  data  communications,  that  can 
affect  an  entire  organization.  For  example,  providing  unrestricted,  uncontrolled 
access  to  data  maintained  on  an  organization's  mainframe  or  minicomputer 
svstem  presents  obvious  data  security  risks .  . .  .Management  policies  are 
necessary  to  fullv  capitalize  on  the  unique  characteristics  oT  the  microcomputer 
and  to  ensure  that  productivity  is  maximized.  The  breadth  and  scope  oF  the 
necessary  policies  will  depend  on  the  needs  of  the  organization  and  how  its 
microcomputers  are  being  used.  The  most  effective  manner  of  communicating 
policies  in  this  area  seems  to  be  to  set  them  forth  in  writing  and  distribute  them 
to  users  in  the  form.of  a  user's  manual  or  microcomputer  guide  ....  [Ref.  10:  p. 


The  Department  of  the  Defense  Inspector  General  has  published  guidance 
on  using  computer  technology  in  auditing.  The  guidance  is  directed  to  defense  internal 
audit,  internal  review  and  military  exchange  audit  organizations.  Only  one  section  of 
the  chapter  on  Computer  Assisted  Audits  contains  mandatory  guidelines  for  audit 
organizations.  [Ref.  13] 

The  mandatory  policies  include: 

•  Establish  a  program  for  integrating  computerized  techniques  into  the  audit 
process.  The  program  should  identify  and  test  new  audit  applications,  provide 
technical  assistance  to  the  audit  staff  and  publicize  computerized  audit 
techniques. 

•  Encourage  planning  for  the  effective  and  efficient  use  of  available  computer 
resources  td  increase  auditor  productivity  and  improve  the  quality  of  audit 
products.  The  need  for  microcomputers  to  aid  the  audit  function  will  be 
assessed  and  requirements  developed  to  support  budget  requests  for  computer 
resources. 

•  Implement  effective  controls  and  oversight  over  use  of  computerized  techniques 
to  help  ensure  that  reliable  and  accurate  audit  results  are  obtained.  The 
controls  shall  address  the  adequacv  of  (a)  data  entrv  and  verification  processes, 
(b)  data  management  practices,  (c)  audit  software  application  development, 
testing,  and  documentation  procedures,  and  (d)  supervisory  reviews  and 
approval  of  computer  generated  analyses. 

•  Ensure  information  security  policies  and  procedures  for  protecting  sensitive  data 
are  followed  when  this  data  is  retrieved,  processed  or  stored  during  a  computer 
assisted  audit. 
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•  Develop  and  implement  training  programs  to  provide  auditors  the  opportunity 
to  become  familiar  with,  or  proficient  in  the  effective  use  of  computers  in 
qondpcting  audits.  In  addition,  audit  managers  and  supervisors  will  become 
tamiliar  with  the  capabilities  of  computer  software  used  by  their  staff. 

•  Document  computer  use  in  performing  an  audit  in  the  audit  working  papers. 
This  documentation  should  allow  the  reviewer  to  recreate  the  computer  process. 
Develop  procedures  for  retaining  and  storing  electronic  workpapers  and  other 
automated  evidence  used  in  support  of  the  audit  report  [Ref.  13:  pp.  3-5]. 

The  remainder  of  the  instruction  discusses  policies  and  procedures  audit 
organizations  should  consider  while  using  microcomputer  technology  in  performing 
audits.  The  topics  discussed  include: 

•  Front  end  planning  of  computer  resource  use  on  audits-the  planning  should 
cover  availability  of  computer  resources,  where  audit  productivity  can  be 
increased  through  computer  use,  skill  level  of  the  audit  staff  and  environmental 
factors  that  could  affect  the  use  of  computers. 

•  Pata  entrv  techniques  and  procedures  used  for  computer  audits-topics  covered 
include  direct  data  entry  and  downloading  data  from  other  computer  systems. 

•  Data  management  to  ensure  data  integrity. 

•  Data  verification  procedures  for  ensuring  reliability  of  source  data  and  accuracy 
after  data  entry. 

•  Software  controls  that  ensure  programs  and  specific  applications  are  operating 
correctly  and  perform  as  intended. 

•  Quality  assurance  over  computer  auditing  techniques  and  results. 

•  Automated  working  paper  standards.  [Ref.  13:  pp.  3-5]. 

Audit  organizations  are  responsible  for  implementing  the  mandatory  and  optional 
procedures.  This  instruction  contains  only  general  guidance  and  does  not  discuss 
specifics  of  implementation. 

The  Naval  Audit  Service  has  initiated  some  policies  and  procedures  to 
comply  with  DoD's  mandatory  guidelines.  The  emphasis  of  these  policies  are  in  the 
areas  of  hardware  and  software  asset  protection.  Each  region  has  appointed  a 
Regional  Automated  Systems  Administrator.  The  responsibilities  of  this  posistion  are 
to  maintain  an  inventory  of  hardware  and  software  assets,  assist  auditors  in  using 
microcomputers,  and  collect  usage  statisitics  from  the  audit  sites  with  microcomputers. 
In  addition,  the  Naval  Audit  Service  Western  Region  has  required  that  microcomputer 
needs  and  requirements  be  projected  for  all  audits  scheduled  during  the  fiscal  year. 
[Ref.  14]  The  Naval  Audit  Service  is  developing  procedures  and  policies  for  the 
remainder  of  the  mandatory  guidelines. 


c.  Microcomputer  Software  Acquisition  Policies 

Software  acquisition  is  the  most  important  consideration  in  procuring 
microcomputer  systems  because  the  software  is  the  system  component  that  makes  the 
microcomputer  useful.  Compatibility  is  paramount  to  the  easy  exchange  of 
information.  Re-keying  of  data  and  re-writing  of  findings  will  be  required  to  produce  a 
final,  consolidated  audit  report  if  each  auditor  uses  incompatible  software  during 
fieldwork.  [Ref.  10:  p.  23] 

Selecting  particular  software  can  be  confusing.  The  software  market 
presents  a  bountiful  table  for  the  microcomputer  user.  However,  the  buyer  must 
beware!  Software  varies  by  vendor  as  to  price,  quality,  purpose,  guarantee,  and  proven 
performance.  The  following  are  some  ways  to  increase  the  probability  of  selecting  good 
quality  software: 

•  If  at  all  possible,  stav  with  the  market  leaders.  Programs  that  have  achieved 
widespread  acceptance  are  generally  reliable.  . . . 

•  Place  heavy  emphasis  on  user-friendliness.  .  . . 

•  Seek  evaluations  from  other  users . . .  .Check  with  similar  .  .  .  organizations  and 
review  references  from  hardware  and/or  the  other  software  vendors  .  . . 

•  Test  software  thoroughly!  . . .  [Ref.  10:  p.  25] 

4.  Objectives  and  Methods  in  Using  Microcomputers 

The  microcomputer  is  primarily  a  personal  work  station.  Accordingly, 
objectives  and  methods  for  using  microcomputers  should  be  oriented  toward  the 
individual  in  the  organization.  Many  procedures  are  susceptible  to  automation.  But 
susceptibility  does  not  necessarily  mean  preferability.  Before  automating  a  procedure, 
evaluate  the  usefulness  of  that  procedure  in  both  the  manual  and  the  automated 
format.  It  may  be  that  automating  a  particular  procedure  does  not  add  anything  to 
efficiency.  [Ref.  12:  p.  6]  And,  although  microcomputers  are  more  flexible  than 
mainframe  computers,  they  still  require  discipline  in  following  organizational  plans  and 
policies  designed  for  efficient  and  effective  use  of  microcomputer  systems. 

A  study  conducted  in  the  1950’s  by  the  Harvard  Business  School  found  that 
many  companies  automated  their  processes  primarily  to  increase  capacity-not  to 
decrease  costs.  Decreasing  costs  was  a  secondary  reason  for  automating.  [Ref.  11:  p. 
83]  At  a  recent  conference,  Naval  Audit  Service  management  estimated  their  workload 
at  50  years,  with  current  staff  levels.  So,  the  reasons  of  30  years  ago  for  automating 
factory  processes  are  still  valid  and  applicable  to  automating  clerical  procedures.  The 
primary  objective  is  still  increasing  the  capacity  to  perform  work.  The  objectives  of 


automation  applied  to  microcomputers  can  be  summarized  in  the  following  advantages 
and  disadvantages: 

Advantages 

•  Increased  capacity  and  ability  to  expand  production  with  little  or  no  additional 
infusion  oflabor 

•  Reduced  direct  labor  content  of  tasks 

•  Shorter  lead  times  for  task  accomplishment 

•  Less  wasted  effort  (i.e.,  greater  effectiveness) 

•  Higher  productivity 

•  Increased  utilization  of  available  resources 

•  Improved  morale 

•  .  Increased  flexibility 

•  Less  training  required 

•  Shorter  set-up  time,  on-site 
Disadvantages 

•  Higher  capital  investment 

•  Higher  maintenance  costs 

•  Longer  design-time 

•  Troublesome  de-bugging  during  the  start-up  period 

•  Serious  compounding  of  downtime,  without  proper  planning 

•  Need  for  enhanced  skills  in  using  new  microcomputer  tool 

•  Need  for  greater  understanding  of  processes  involved  in  generating  output  and 
how  to  interpret  that  output  based  on  the  input 

•  Reluctance  or  inability  of  some  members  of  the  organization  to  adapt  to 
microcomputers  [Ref.  IT:  p.  80 J 

5.  Constraints  In  the  Microcomputer  Operating  Environment 

a.  Physical  Constraints 

Microcomputers  are  not  universally  useful.  Their  most  obvious  limitation  is 
their  requirement  for  electricity  to  operate,  followed  by  their  sometimes  awkward 
physical  dimensions  and  weight.  The  auditor  should  consider  the  following  factors 
when  deciding  to  employ  a  microcomputer: 

•  Availability  of  electricity  in  the  correct  voltage,  type  of  current,  and  convenient 
location 

•  Necessity  for  proper  identification  of  the  equipment  and  its  carrier  for  access  to 
controlled  military’  facilities 

•  The  storage  and  manipulation  of  classified  information  and  the  need  for 
machine  certification  tor  the  level  of  classified  information  to  be  used 

•  Requirements  for  a  table  or  desk  for  the  microcomputer 


•  Requirements  for  a  telephone  line  with  appropriate  connectors  for  a  modem 
ana  a  telephone  handset 

•  Proper  packaging  to  protect  the  microcomputer  from  damage  in  shipment  if 
earned  on  a  common  earner  while  travelling  and  any  excess  baggage  charges 

•  Provisions  for  carrying  cumbersome,  'luggable'  microcomputers  that  weigh  25 
to  30  pounds 

•  Security  precautions  to  prevent  loss  from  theft,  or  damage  due  to  carelessness 

•  Protection  against  extreme  temperatures 

b.  Operating  Constraints  During  Downtime 

Management  should  develop  a  plan  of  action  to  prevent  cessation  of 
operations  when  a  microcomputer  fails  to  operate  or  malfunctions.  The  easiest 
protection  against  work  stoppage  due  to  microcomputer  malfunction  is  to  have  a  spare 
microcomputer  on-hand  and  ready  to  use  in  place  of  the  failed  unit.  With  the  variety 
and  dependability  of  overnight  package  delivery  services  in  most  areas  that  the  Naval 
Audit  Service  works,  travelling  audit  teams  may  depend  on  overnight  delivery  of  a 
spare  unit  from  a  central  location,  rather  than  carrying  a  spare  with’ them.  The  low 
cost  of  microcomputers  makes  this  a  feasible  alternative  for  the  Naval  Audit  Service. 
This  requires  that  the  auditor,  or  some  member  of  the  audit  team,  be  knowledgeable 
enough  to  make  the  proper  connections  to  set  up  the  spare  unit.  It  may  also  mean 
removing  the  hard  disk  unit  from  the  failed  unit  and  installing  it  in  the  spare  unit. 
Travelling  auditors  might  consider  carrying  a  small  tool  box  as  part  of  the 
microcomputer  hardware.  Also,  the  auditor-in-charge  should  have  a  pre-determined 
plan  of  alternate  tasks  that  can  be  accomplished  manually  while  waiting  for  the  spare 
unit  to  arrive,  or  the  broken  unit  to  be  repaired. 

Normal  preventive  maintenance  on  microcomputers  will  inevitably  have  to 
be  performed  if  the  units  experience  any  kind  of  prolonged  use.  This  maintenance 
should  be  scheduled  during  anticipated  idle  periods  to  prevent  disruption  of  audit 
operations. 

The  adverse  impact  of  downtime  manifests  itself  in  loss  of  productive  time 
and  could  have  a  cumulative  elTect  on  the  entire  audit,  not  just  the  current  task  being 
performed.  This  adverse  impact  can  be  minimized  by  appropriate  planning.  [Ref.  11:  p. 
151] 

c.  User  Constraints 

Finally,  the  average  microcomputer  user  does  not  have,  and  probably 
should  not  have,  a  detailed  understanding  of  the  inner  workings  of  the  microcomputer 


hardware  and  the  software.  However,  this  does  not  relieve  the  auditor  of  the  general 
responsibility  for  maintaining  the  quality  of  the  audit  results  when  using  the 
microcomputer  in  the  conduct  of  the  audit.  Auditors  who  are  unfamiliar  with 
microcomputers  may  not  recognize  problems  as  they  occur.  Errors  introduced  to  a 
microcomputer  are  automatically  multiplied  throughout  the  rest  of  the  automatic 
analysis.  [Ref.  15:  p.  1] 

E.  NAVAL  AUDIT  SERVICE  WORKLOAD 

The  Naval  Audit  Service  is  responsible  for  audits  of  all  Navy  and  Marine  Corps 
activities  and  functions.  This  covers  all  aspects  of  their  operations.  The  auditors  are 
located  at  various  Navy  and  Marine  Corps  operations  througout  the  world.  The 
workload  is  divided  into  audit  tasks  and  administrative  tasks.  Audit  tasks  are 
performed  by  auditors  and  audit  managers  to  satisfy  the  audit  objectives. 
Administrative  tasks  refer  to  recurring  requirements  that  are  performed  throughout  the 
year  regardless  of  the  specific  audit.  An  analysis  of  the  Naval  Audit  Service  workload 
is  contained  in  this  section.  The  objective  of  this  analysis  is  to  determine  the  best  way 
to  assimilate  microcomputers  into  the  work  process. 

Audit  tasks  refer  to  the  planning,  performing,  analysis,  and  write-up  of  the  final 
audit  report.  Chapter  3  of  this  thesis  contains  specific  examples  of  microcomputer 
applications  for  performing  audit  processes.  Microcomputer  technology  is  ideal  for 
repetitive  tasks.  Once  a  software  application  is  developed  it  can  be  used  every  time 
that  specific  audit  step  is  performed.  The  Naval  Audit  Service's  workload  was 
analyzed  for  the  amount  of  repetition  and  similiar  tasks  it  contained. 

The  Naval  Audit  Service's  workload  is  categorized  into  several  different  types  of 
audits.  Descriptions  of  some  of  the  audit  types  and  their  objectives  are  as  follows: 

l.  Audit  Types 

a.  Activity  Audits  ( Identified  as  "A"  and  MB"  audits) 

These  audits  determine  the  compliance  with  laws  and  regulations  and 
evaluate  the  internal  controls  in  place  at  one  location.  These  audits  are  performed  on 
a  regular  schedule  generally  every  three  to  five  years.  These  audits  are  usually 
performed  by  a  mobile  audit  team  unless  there  is  a  Naval  Audit  Site  located  at  the 
activity.  [Ref.  16:  para  302] 
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b.  Continuous  Audits  {Identified  as  "C  audits ) 

These  are  activity  audits  that  are  separated  into  phases  and  performed  on  a 
continuous  basis  by  a  resident  audit  staff  at  an  audit  site.  Activities  selected  for 
continuous  audit  coverage  are  major  ones  at  which  a  heavy  volume  of  work  is  required. 
Each  audit  phase  covers  one  or  more  functional  areas  cyclically  to  produce 
comprehensive  coverage  of  functions  of  audit  interest.  These  audit  phases  are 
performed  on  a  three  to  five  year  schedule.  [Ref.  16:  para  302.4] 

c.  Concurrent  Audits  (  Identified  as  MA",  " B ",  or  HCr) 

These  are  audits  of  similar  functions  performed  at  similar  activities  (e.g.  all 
or  most  shipyards  or  supply  centers).  The  purpose  of  these  audits  is  to  assess 
conditions  more  effectively  and  consistently  on  a  Navy-wide  basis.  These  audits  are 
performed  on  an  as-needed  basis.  [Ref.  16:  para  302.5] 

d.  Intra  Department  of  the  Navy  Multilocation  Audits  {Identified  as  "T"  audits) 

These  audits  provide  concurrent  coverage  of  a  prdblem,  program,  or 

function  at  two  or  more  activites.  The  purpose  of  these  audits  is  to  achieve  a  regional 
or  service-wide  assessment  of  performance  trends  and  accomplishments.  The  audit  is 
normally  coordinated  by  a  single  regional  office  for  all  regional  offices.  The 
coordinating  office  is  responsible  for  consolidating  the  findings  and  publishing  the  audit 
report.  These  audits  are  performed  on  an  as-needed  basis.  [Ref.  16:  para  303] 

e.  System  Reviews  {Identified  as  "D*  audits) 

These  audits  include  a  review  of  operational  and  developmental  automated 
systems.  The  audit  objectives  are  (1)  to  appraise  the  adequacy  of  controls,  (2)  to  verify 
compliance  with  applicable  standards,  regulations,  and  design  specifications,  (3)  to 
review  system  documentation,  and  (4)  to  assess  the  efficiency  and  economy  of  system 
operations  or  developmental  efforts.  They  are  performed  on  an  as-needed  basis. 
[Ref.  16:  para  305.  i] 

f  Project  Management  Reviews  {Identified  as  "IT  audits) 

These  audits  assess  the  effectiveness  of  the  management  and  control  of 
major  procurement  projects  in  the  Navy.  The  audit  objectives  are  to  ensure 
compliance  with  requirements  and  regulations  relating  to  contractual  procurement. 
These  audits  are  normally  only  performed  by  the  Capital  Region  which  is  located  in 
Washington,  D.C.  [Ref.  16:  para  305.2] 


g.  Unannounced  Disbursing  Audits  (  Identified  as  "X"  audits) 

These  audits  are  done  on  a  surprise  basis  and  include  a  verification  of  the 
disbursing  officer's  cash  account  as  well  as  an  evaluation  of  the  officer's  verification 
program.  A  comprehensive  review  of  the  disbursing  operation  is  performed  only  when 
the  verification  program  is  considered  inadequate.  Normally,  comprehensive  reviews  of 
disbursing  operations  are  part  of  activity  audits.  [Ref.  16:  para  305.3] 

h.  Command  Request  Audits  ( Identified  as  "SM  audits) 

These  audits  originate  as  the  result  of  a  written  request  received  by  the 
Naval  Audit  Service  from  a  command.  The  request  includes  the  size,  scope,  and 
urgency  of  the  audit.  In  addition,  the  request  states  whether  the  work  is  in.  the  purview 
of  an  audit  or  requires  another  type  of  assistance.  [Ref.  16:  para  306] 

i.  Commercial  Activity  Reviews  ( Identified  as  "V"  audits) 

These  audits  certify  in-house  cost  estimates  for  commercial  activity  type 
functions  that  exceed  threshholds  establshed  by  the  Secretary  of  the  Navy.  These 
audits  substantiate  the  currentness,  reasonableness,  and  completeness  of  those 
estimates  as  required  by  OMB,  DOD,  and  DON  guidance.  [Ref.  16:  para  308.2] 

j.  Investigative  Assists  {Identified  as  "J*  audits) 

These  audits  involve  assisting  investigative  organizations  (e.g.  NTS  and  the 
FBI)  and  are  performed  under  the  auspices  of  the  requesting  investigative  organization. 
The  work  consists  of  performing  audit-like  tasks  on  cases  under  investigation.  These 
audits  are  performed  on  an  as-needed  basis.  [Ref.  16:  para  308.1] 

k.  Audit  Research  ( Identified  as  "Q*  audits) 

These  audits  determine  the  feasibility  of  an  audit  in  a  particular  activity  or 
functional  area.  Background  data  are  gathered  and  analyzed  to  determine  the  need  for 
audit  in  that  area.  These  audits  are  performed  on  an  as-needed  basis.  [Ref.  16:  para 
308.4] 

The  above  audit  types  accounted  for  almost  94%  of  the  Naval  Audit 
Service's  Fiscal  Year  1986  audit  workload.  [Ref.  17]  As  shown  in  the  graph  in  Figure 
2.1,  activity,  continuous,  special  request  and  multilocation  audits  accounted  for 
approximately  82%  of  the  work.  Unfortunately,  a  breakdown  of  workload  by  audit 
type  does  not  provide  much  guidance  on  where  microcomputers  can  be  used  best. 
These  audit  types  only  provide  a  general  definition  of  the  audit  workload. 
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Figure  2.1  Distribution  of  Direct  Audit  Hours  by  Audit  Type. 


Another  workload  breakdown  is  provided  by  the  functional  areas  to  which 
auditors  charge  their  time  on  the  bi-weekly  timesheets.  The  Naval  Audit  Service  has 
35  work  measurement  codes  that  are  used  to  identify  direct  audit  hours  worked  on  an 
audit.  A  list  of  the  work  measurement  codes  and  functional  programs  is  contained  in 
Table  1.  In  fiscal  year  1986  all  35  of  these  w’ork  measurement  codes  were  charged  with 
audit  hours.  However,  only  two  of  the  work  measurement  codes  contained  over  10% 
of  the  total  auditor  and  auditor-in-charge  man-hours  for  the  Naval  Audit  Service. 
These  two  functional  programs  were  Other  Comptroller  and  AIC  Planning,  Supervising 
and  Review.  Naval  Audit  Service  workload  is  so  diverse  that  there  were  only  five  other 
functional  programs  which  had  more  than  5%  of  the  total  organization's  auditor  and 
auditor-in-charge  direct  work  hours  charged  to  them.  These  five  functional  programs 
were  Contract  Administration,  Rebuild  and  Overhaul  of  Equipment,  Supply  Operations 
Retail,  Information  Technology,  and  Investigative  Support.  [Ref.  18]  This  diversity  of 
workload  makes  it  difficult  to  identify  specific  areas  in  which  microcomputer 
technology  can  be  concentrated  to  provide  the  most  benefit  to  the  organization. 
However,  this  information  can  be  used  to  identify  functional  areas  in  Naval  Audit 
Service  standard  audit  programs  which  should  be  reviewed  for  potential  automation. 

The  Naval  Audit  Service  has  44  standard  audit  programs  for  use  by  its 
auditors.  These  programs  list  specific  audit  steps  to  perform  for  an  audit  and  are  the 
auditors'  primary  tool.  These  programs  also  provide  a  checklist  for  reviewing 
compliance  with  law's  and  regulations  applicable  to  the  functional  area  program  or 
issue.  Audit  programs  are  developed  for  various  functions  and  programs  audited  on  a 
recurring  basis.  In  some  instances  programs  exist  for  a  particular  audit  type  (e.g. 
Audit  Program  #43,  Project  Management  Audits).  However,  most  programs  are  used 
on  a  variety  of  audit  types.  In  addition,  some  audit  types  (e.g.  Multilocation  ("T  ") 
Audits  and  Special  Request  ("S")  Audits)  require  that  a  specialized  audit  program  be 
developed  each  time  an  audit  is  performed. 

Currently,  the  Naval  Audit  Service  does  not  track  audit  program  usage  by 
specific  audits.  Thus,  it  is  not  possible  to  determine  which  programs  were  used  most. 
An  attempt  was  made  to  correlate  audit  programs  to  specific  functional  areas.  The 
standard  audit  programs  were  matched  to  the  appropriate  functional  areas  where 
possible.  The  results  are  shown  in  Table  2.  This  analysis  does  not  provide  an  accurate 
breakdown  of  specific  workload,  since  programs  are  used  on  several  different  functional 
areas.  In  addition,  several  different  programs  may  be  used  for  one  functional  area. 
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FUNCTIONAL  AREAS  AUDITED  BY  THE  NAVAL  AUDIT  SERVICE 


Code  Function 

01  Research  and  Development 

02  Test  and  Evaluation 

03  Major  System  Acquisition 

04  Procurement  -  Inventory  Control  Activities 

05  Procurement  -  Research  and  Development 

06  Procurement  -  Other 

07  Contract  Administration 

08  Forces  Management 

09  Maintenance  and  Repair  of  Equipment 

10  Rebuild  and  Overhaul  of  Equipment 

11  Manufacturing  and  Production 

12  Supply  Operations  -  Wholesale 

13  Supply  Operations  -  Retail 

14  Property  Disposal 

15  Civilian  Personnel  Management 

16  Military  Personnel  Management 

17  *  Real  and  Installed  Property 

18  Construction 

19  Information  Technology 

20  Intelligence  and  Security 

21  Communications 

22  Transportation 

23  Military  Pay  and  Benefits 

24  Civilian  Pay  and  Benefits 

25  Program  and  Budget 

26  Other  Comptroller  Functions 

27  Support  Services 

28  Nonappropriated  Fund  Activities 

29  Security  Assistance  Program 

30  Commercial  Activities 

31  Investigative  Support 

32  Health  Care 

33  Not  Used 

34  Other 

35  AIC's  Planning,  Supervision  and  Review 

36  Assistant  Director's  Planning,  Supervision  and  Review 


! 

i  The  Naval  Audit  Service's  workload  is  so  diverse  that  developing  standard 

|  microcomputer  audit  applications  will  be  difficult  and  will  require  a  great  deal  of  time. 

Even  then  all  audits  will  not  have  a  base  of  applications  for  use.  Probably  the  best 
way  to  divide  and  categorize  Naval  Audit  Service  workload  is  by  the  activity  audited. 
Currently,  there  are  continuous  audit  sites  at  several  different  types  of  activities.  There 
are  sites  at  six  headquarters  activities,  two  inventory  control  points,  six  integrated 
aeronautical  complexes,  eight  Naval  Shipyards,  and  four  Supply  Centers.  The 
remaining  sites  are  at  unique  Navy  and  Marine  Corps 
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TABLE  2 

MATCH  OF  AUDIT  PROGRAMS  TO  FUNCTIONAL  AREAS 

Function  Number  of  Programs 
01  1 

03  1 

04  1 

05  1 

06  2 

07  4 

09  3 

10  3 

12  2 

13  2 

15  1 

17  4 

18  1 

19  4 

20  1 

21  1 

22  3 

23  1 

24  l 

25  1 

26  6 

27  9 

28  1 

30  1 

32  1 

The  functional  areas  not  listed  here  mav  be  covered 
m  existing  programs  but  coverage  was  hot  apparent 
from. the  program  name.  Also,  Tor  the  functional  areas 
identified  there  mav  be  sections  from  other  programs 
that  provide  coverage  of  them. 
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activities.  There  is  some  repetition  of  audits  performed  at  similiar  activities.  Thus, 
microcomputer  audit  applications  could  be  developed  and  shared  among  audit  sites  at 
similiar  activities.  Also,  a  number  of  audits  covering  the  same  functional  areas  are 
performed  at  many  Navy  and  Marine  Corps  activities.  For  example,  audits  of  civilian 
personnel  and  timekeeping  are  performed  at  virtually  every  audit  site.  Microcomputer 
audit  applications  for  these  functional  areas  could  be  reused  every  time  an  audit  is 
performed.  Other  audits  of  certain  functional  areas  or  activities  are  performed  at 
several  locations.  Among  these  are  audits  of  commissary  stores,  morale,  welfare  and 
recreation  activites,  and  Personnel  Support  Activities.  Microcomputer  audit 
applications  developed  for  an  audit  of  one  activity  should  be  transportable  to  audits  of 
similiar  actfvites.  However,  these  audit  applications  should  not  be  reused  without 
considering  any  unique  conditions  that  exist  at  the  audited  activity.  The 
microcomputer  applications  should  be  reviewed  in  the  same  manner  as  audit  programs. 
The  audit  program  steps  may  require  refinement  to  fit  the  audited  activity.  The  audit 
applications  may  require  the  same  type  of  refinement  to  satisfy  the  objectives  of  the 
audit  step.  However,  it  is  much  easier  to  modify  an  existing  application  than  it  is  to 
create  a  new  one. 

Although  it  \^ill  take  time  to  develop  microcomputer  applications  for 
performing  audit  data  gathering  and  analysis  there  is  one  audit  task  that  benefits 
immediately  from  microcomputer  use.  The  use  of  word  processing  software  to  produce 
written  audit  material  is  very  beneficial  to  auditors  and  audit  managers.  Audit  written 
material  includes  audit  announcement  letters,  survey  debriefs,  findings  and  the  final 
audit  report.  These  documents  have  a  specified  format.  The  word  processing  software 
allows  users  to  design  a  unique  format  for  individual  documents  and  insert  and  delete 
text  where  needed.  The  Naval  Audit  Service  could  develop  a  word  processing  format 
for  these  recurring  documents  and  distribute  them  throughout  the  organization. 
Auditors  and  audit  managers  would  add  the  necessary  text  to  the  document  and  revise 
the  document  as  needed.  Also,  the  ability  to  change  portions  of  the  text  in  an  audit 
finding  or  report  will  speed  up  the  editing  process  and  decrease  the  audit  time. 

Personnel  scheduling  and  management,  time  reporting,  budgeting,  audit 
planning  and  performance  evaluations  are  some  of  the  administrative  tasks  performed 
by  auditors  and  audit  managers.  These  tasks  are  characterized  by  known  requirements, 
standards,  reporting  formats  and  known  deadlines.  All  of  these  factors  make  it 
possible  for  these  tasks  to  be  performed  using  microcomputers.  The  Naval  Audit 


Service  can  develop  software  applications  for  performing  these  tasks  using  the 
organization's  existing  software.  Chapter  3  of  this  thesis  contains  specific  examples  of 
how  this  software  can  be  used  for  these  administrative  tasks. 


F.  INTRODUCING  MICROCOMPUTERS  SUCCESSFULLY 
1.  General  Implementation  Strategies 

Tharrington  suggests  that  the  following  microcomputer  specific  methods  will 
ensure  successful  microcomputer  implementation  and  use  in  organizations: 

•  Establish  and  maintain  a  large  microcomputer  software  librarv  for 
organizational  use. 

•  Restrict  microcomputer  use  to  small  files  and  small  data  bases,  in  relation  to 
mainframe  files  and  data  bases.  Continue  processing  large  files  and  performing 
lengthy  calculations  on  the  mainframe  computer. 

•  Establish  a  microcomputer  steering  committee.  Committee  members  should 
come  from  the  user  groups,  the  data  processing  department,  and  senior 
managers.  The  committee  functions  to  evaluate  hardware  and  software  requests, 
to  set  priorities  for  microcomputer  use  and  procurement,  and  to  set 
microcomputer  policies  and  procedures. 

•  The  organization  should. name  a  microcomputer  coordinator.  The  coordinator  s 
purpose  is  to  be  a  liaison  with  vendors  and  hardw-are  repairmen.  The 
coordinator  should  also  be  technically,  administratively,  and  procedural^ 
competent  to  answer  user  questions. 

•  Establish  microcomputer  objectives.  But,  allow  the  users  to  develop  what  they 
consider  high  priority  applications  with  off-the-shelf  software. 

•  Introduce  the  microcomputer  as  a  sophisticated  audit  and  management  tool  for 
everyone.  The  objective  should  be  that  the  microcomputer  becomes  as  common 
a  device  as  an  electronic  calculator  or  a  typewriter. 

•  Develop  methods  to  measure  cost  savings  and  increased  efTiciencv.  Although 
these  are  olten  difficult  to  measure,  thev  must  be  measured  both  fo  justify  tne 
current  investment  and  the  continued  use  of  microcomputers,  and  to  justify 
future  procurement  of  new  technology.  [Ref.  I9j 

As  with  any  productivity  tool,  microcomputers  have  an  expected  useful  life. 
Long-term  planning  for  the  complete  utilization  of  the  microcomputer  and  its  eventual 
replacement  will  ensure  that  the  Naval  Audit  Service  obtains  the  maximum  benefits 
available  from  the  microcomputer  on  a  continuing  basis.  Formal  life-cycle  management 
of  microcomputers  lends  credence  to  them  as  items  of  permanence  and  strategic  value 
to  the  Naval  Audit  Service.  The  Naval  Data  Automation  Command  prescribes  formal 
life-cycle  Management  for  major  ADP  equipment  in  SECNAVINST  5231.1b,  "Life 
Cycle  Management  (LCM)  Policy  and  Approval  Requirements  for  Information  System 
(IS)  Projects."  Life-cycle  management  is  defined  as: 


...  the  process  for  administering  an  AIS  over  its  whole  life  with  emphasis  on 
strengthening  early  decisions  which  shape  AIS  costs  and  utilitv.  These  decisions 
must  oe  based  on  full  consideration  of  functional.  ADP.  and  telecommunications 
requirements  in  order  to  produce  an  effective  AIS  [Ref.  20). 


Although  life-cycle  management  is  not  required  for  microcomputer  systems  as  it  is 
required  for  major  AIS,  developing  a  strategic  plan  for  managing  the  microcomputer  is 
a  viable  method  of  maintaining  the  microcomputer  as  an  effective  and  important  audit 
tool.  The  Air  Force  Audit  Agency  has  developed  a  long-range  plan  and  policy 
statement  for  the  use  of  its  microcomputers. 

2.  Communicating  Microcomputer  Information  to  the  Organization 

Maintaining  a  central  software  library  is  one  method  of  collecting  useful 
programs.  A  central  software  library  also  gives  every  user  in  the  organization  access  to 
labor-saving  software. 

In  addition  to  the  central  software  library  the  Naval  Audit  Service  should 
consider  creating  a  central  library  of  microcomputer  audit  applications.  This  library 
would  contain  individual  applications  (e.g.  Lotus  spreadsheet  templates,  dBASE  III 
programs)  that  were  developed  and  used  on  an  audit  or  for  an  administrative  task. 
The  library  entry  could  contain  a  description  of  the  application,  software  used,  audit 
program  step  or  task  used  on,  identification  number  of  the  audit  application  was  used 
on,  and  results  achieved. 

A  simplified  version  of  an  audit  application  library  system  was  developed  by 
the  authors  and  two  associates  using  dBASE  III  Plus.  The  library  system,  called  The 
Naval  Audit  Service  Software  Application  Data  Base,  contains  three  files. 

•  Program  File  -  Records  in  this  file  contain  steps  from  the  Naval  Audit  Service 
audit  guide  programs. 

•  Application  File  -  Records  in  this  file  contain  the  audit  application  name, 
application  developer,  application  description,  audit  program  step  used  for  and 
software  package  application  used  on. 

•  Historv  File  -  Records  in  this  file  contain  the  audit  identification  numbers  and 
the  audit  application  name. 

The  Naval  Audit  Service  Software  Application  Data  Base  program  allows  the 
user  to  add,  delete,  modify  or  search  for  a  record  from  any  of  the  three  files.  Also, 
data  from  separate  files  can  be  combined  to  meet  a  user  specified  condition.  For 
example,  the  user  could  produce  a  listing  of  all  software  applications  developed  for  a 
specific  audit  program. .  Also,  the  program  allows  the  user  to  perform  ad  hoc  queries  of 
the  files  through  use  of  the  dBASE  III  Plus  query  program.  The  various  files  and 
capabilities  of  the  program  are  accessed  through  a  series  of  menus.  This  makes  the 
program  easy  to  use  and  user  friendly. 

A  database  application  similiar  to  this  would  be  easy  to  implement  in  the 
Naval  Audit  Service.  Information  contained  on  the  data  base  could  be  distributed  to 
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auditors  in  several  ways.  Print  outs  of  the  data  base  could  be  incorporated  into  a 
microcomputer  newsletter.  A  floppy  diskette  containing  the  data  base  could  be 
distributed  to  the  audit  sites  periodically.  Finally,  the  data  base  could  be  on-line  and 
accessed  by  auditors  through  a  Naval  Audit  Service  electronic  bulletin  board. 

The  Air  Force  Audit  Agency  has  published  “A  Microcomputer  Applications 
Guide-  to  communicate  information  about  microcomputers  to  its  auditors  and  audit 
managers.  This  guide  contains  a  description  of  the  software  tools  available  in  the 
oranization  and  a  series  of  audit  applications  available  for  use  during  each  phase  of  the 
audit  process.  The  guide  will  be  updated  periodically  to  reflect  new  applications. 

3.  Newsletters  and  Electronic  Bulletin  Boards 

A  microcomputer  newsletter  is  another  means  of  distributing  information 
about  microcomputers  to  the  audit  organization.  The  newsletter  would  keep  users 
abreast  of  changes  in  the  organization's  data  processing  capabilities,  new  developments 
in  hardware  and  software,  and  provide  users  with  new  ideas  and  recommendations  for 
using  microcomputers.  Material  for  the  newsletter  is  available  from  many  sources  and 
is  often  available  at  no  charge.  The  newsletter  should  be  written  in  nontechnical  terms 
with  a  minimum  of  computer  jargon.  The  newsletter  should  be  published  regularly  so 
that  it  becomes  an  anticipated  part  of  organizational  operations. 

Instead  of  creating  a  separate  newsletter  the  Naval  Audit  Service  could 
incorporate  microcomputer  news  into  the  "Staff  Notes  of  the  Auditor  General".  This 
publication  is  produced  bi-monthly.  The  microcomputer  news  could  become  a  regular 
feature  like  the  current  statistics  article  "Math  Path  to  Audit  Trails".  Another  option 
for  distributing  microcomputer  news  is  through  the  existing  regional  newsletters. 

Electronic  bulletin  boards  can  also  be  used  to  enhance  the  microcomputer's 
usefulness  to  the  Naval  Audit  Service  and  to  help  ease  introduction  of  the 
microcomputer  into  the  Naval  Audit  Service.  Electronic  bulletin  boards  can  be  either 
an  alternative  to  or  in  addition  to  newsletters.  The  electronic  bulletin  board's  major 
advantage,  when  used  as  an  alternative  to  newsletters,  is  saving  of  printing  and 
distribution  costs.  Electronic  bulletin  boards  also  can  be  used  to  send  and  receive 
electronic  mail.  The  bulletin  board  could  be  set  up  at  a  central  site  (headquarters,  for 
example)  and  used  to  send  and  receive  news  that  would  normally  be  printed  in  a 
newsletter.  The  electronic  bulletin  board,  in  the  reverse,  can  be  used  as  a  receiving 
station  for  reports  and  high-priority  mail. 
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Electronic  bulletin  boards  are  software  based  systems  that  allow  remote  users 
to  access  a  computer  at  a  central  site.  The  bulletin  board  software  provides  the 
organization  with  a  means  of  sharing  information  among  its  employees  and  allows 
users  at  different  locations  to  access  and  exchange  information  and  ideas.  The  features 
of  the  bulletin  board  software  include  password  security  systems,  file-transfer 
capabilities,  networking  capability  among  others. 

A  final  method  for  communicating  microcomputer  information  to  an 
organization  is  through  use  of  a  support  group.  The  primary  mission  of  such  a  group 
is  to  manage  and  deliver  goods  and  services  related  to  the  application  of 
microcomputer  technology.  [Ref.  21]  The  services  a  support  group  could  offer  include: 

•  Consultation 

•  Requirements  analysis 

•  Training  and  product  demonstration 

•  Internal  newsletter  production 

•  Information  clearinghouse  services  [Ref.  21] 

The  Air  Force  Audit  Agency  has  established  a  Small  Computer  Technical  Center  to 
help  its  auditors  use  microcomputers  for  performing  audit  tasks.  Many  of  the  services 
listed  above  are  provided  by  this  organizational  component.  Currently,  the  Naval 
Audit  Service  relies  on  regional  systems  administrators  and  auditors  experienced  in 
using  microcomputers  to  provide  these  types  of  services.  Development  of  a 
microcomputer  support  group  would  provide  users  with  one  source  for  microcomputer 
assistance  and  guidance. 
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A.  INTRODUCTION 

This  chapter  explores  the  manner  in  which  microcomputer  software  may  be 
employed  to  increase  the  efficiency  of  Naval  Audit  Service  work.  This  chapter  will  also 
illustrate  specific  ways  in  which  microcomputer  software  can  increase  audit  efficiency, 
and  it  will  suggest  which  categories  of  software  are  appropriate  for  automating  auditing 
and  audit  management  tasks.  Further,  this  chapter  will  review  selected  products  from 
each  of  the  categories  presented  in  this  chapter.  However,  this  chapter  will  not 
recommend  purchases  of  any  particular  software  by  the  Naval  Audit  Service. 

This  discussion  of  microcomputer  software  is  arranged  by  major  audit  and  audit 
management  tasks.  Within  each  category,  selected  software,  useful  for  accomplishing 
each  task,  is  presented  from  three  possible  sources,  i.e.,  commercial  vendors'  software, 
public  domain  and  government  developed  software.  Software  was  tested  with  either 
demonstration  versions  provided  by  the  software  vendor  or  use  of  the  actual 
production  version  of  the  program.  All  figures  for  this  chapter  can  be  found  in 
Appendix  B. 

There  are  many  factors  to  consider  when  choosing  microcomputer  software.  This 
discussion  focuses  on  those  features  that  are  most  important  to  the  general  user. 
[Ref.  22:  p..  30]  These  features  are  program  capabilities,  dialog,  ease  of  use,  the  program 
output  displays,  program  commands  (and  formula  development  in  the  case  of 
spreadsheets),  the  HELP  facility,  error  handling  and  any  unique  features.  The  dialog 
provides  the  interface  between  the  user  and  the  machine.  The  dialog  style  directly 
contributes  to  the  user's  perception  of  the  value  of  a  particular  software  package  and, 
resulting  from  that,  the  frequency  of  use  and  the  quantity  of  tasks  accomplished  with 
that  software.  Sprague  and  Carlson  [Ref.  23:  pp.  198-217]  identify  six  styles  of  dialog 
in  their  discussion  of  decision  support  systems  that  are  generally  applicable  to  most 
application-oriented  software.  These  six  dialogs  are  as  follows: 

•  Question-answer  which  presents  a  series  of  questions  to  the  user,  singlv.  in  plain 
language.  The  user's  response  besets  another  question  from  the  computer  until 
the  computer  program  is  finished"! or  the  user  quits).  This  dialog  is  successful 
lor  inexperienced  or  infrequent  users,  whenever  they  are  unfamiliar  with  the 
problem  at  hand 

•  Command  language,  which  uses  one  word  or  short  phrased  commands  to  initiate 
some  action  from  the  computer  (for  example  the  command:  PRINT  DAILY 


REPORT).  Command  language  is  useful  for  experienced  users  performing 
repetitive  tasks;  it  speeds  up  task  initiation  by  permitting  the  user,  who 
understands  the  solution  to  the  current  problem,  to  solve  the  problem  bv 
ordering  the  solution  directlv,  without  wasting  time  answering  the  computer  s 
questions.  The  disadvantage  of  command  language  is  that  infrequent  users  tend 
to  Forget  the  commands  ana  must  re-learn  them  before  using  the  program 

•  Menu  dialog ,  which  presents  the  user  with  several  choices  that  either  lead  to 
another  menu  or  initiate  action  and  response  from  the  computer.  The  user  onlv 
rieeds  to  select  from  the  menu  to  proceed,  or  quit.  Menu  dialogs  are  effective 
lor  infrequent  users  who  are  familiar  with  tne  problem,  but  mavbe  not  the 
solution 

•  Input  form,  output  form,  which  displays  an  input  form  in  a  stvle  the  user  is 
accustomed  to  seeing  on  paper.  The  user  then  enters  data  on  the  appropriate 
area  within  the  form  and  receives  output  from  the  computer  in  the  same  stvle. 
Input  form  output  form  works  well  in  cases  where  the  forms  are  Familiar  to  the 
user 

•  lnput-in-cqntexi-of -output,  which  presents  an  output  (e.g.,  a  table  or  a  graph  or 
a  list)  within  which  tne  user  may  fi]l  m  or  select  ipputs  that  will  either  modify 
the  current  output  or  result  in  a  different  output.  This  tvpe  of  dialog  is  effective 
in  decision  support  systems  (DSS).that  deal  with  complicated  decision-making 
processes.  The  disadvantage  in  this  dialog  form  is  that  it  requires  significant 

•  Combinations  of  the  first  five  dialog  styles  [Ref.  23:  p.  202]. 

These  combinations  make  programs  flexible  and  adaptable  to  different  levels  of  user 
skill  and  training.  The  popular  word  processing  program  WordStar,  for  example,  has 
three  different  dialogs.  WordStar  can  be  set  to  be  completely  menu  driven  for  the 
beginner.  The  advanced  user  can  work  with  command  language  using  a  callable  help 
menu  displayed  by  a  few*  keystrokes.  The  expert  WordStar  user  can  eliminate  all  menus 
entirely  and  use  command  language  only.  In  summary,  the  correct  dialog  style 
contributes  to  preventing  beginners  from  becoming  frustrated  with  a  program 
command  structure  that  they  do  not  understand  and  cannot  use  correctly;  and, 
conversely,  the  correct  dialog  style  contributes  to  preventing  time-consuming  menu* 
displays  and  question-answer  dialogs  from  hampering  speedy  task  accomplishment  by 
expert  users  [Ref.  23:  p.  202]. 


B.  AUDIT  SERVICE  PROCESSES  TO  AUTOMATE 
1.  Work  Papers 

a.  Introduction  to  Work  Papers 

Work  papers  commonly  contain  a  combination  of  numerical  data  in 
spreadsheet  form,  text,  and  tabular  data  presentations.  The  Naval  Audit  Service 
requires  that  work  papers  contain  tables  of  contents,  audit  reports  crossreferenced  to 
supporting  work  papers,  draft  findings,  checklists,  standard  audit  programs,  debriefs, 
charts,  graphs,  forms,  audit  assignment  letters,  etc.  These  structured  requirements  are 
readily  met  with  the  aid  of  microcomputer  software. 
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Work  papers  are  the  primary  collection  medium  for  the  evidence  collected 
during  audits.  Work  papers  support  conclusions  developed  during  the  audit  and  the 
final  audit  report.  Therefore,  work  papers  should  be  prepared,  maintained  and  handled 
with  great  care.  The  United  States  General  Accounting  Office  (GAO)  "Comprehensive 
Audit  Manual"  describes  the  work  papers'  main  purpose  as 

•  To  provide  a  systematic  record  of  work  performed  in  earning  out  an 
assignment. 

•  To  provide  a  record  of  information  and  evidence  obtained  and  developed  in 
support  of  the  findings,  conclusions,  and  recommendations  made  on  the  basis  ot 
our  work  [Ref.  24:  p~l^-l). 

The  Naval  Audit  Service  defines  work  papers  as 

competent,  and  relevant  evidence  to  support  auditors'  judgments,  conclusions, 
audit  findings,  and  recommendations  in  audit  reports.  Work  papers  should 
clearly  ^show  the  audit  objective(s)  and  scope  of  work  performed.  [Ref.  16:  para 

• 

b.  Methods  for  Generating  Work  Papers 

Electronic  spreadsheet  software  provides  a  direct,  onscreen  capability  for 
producing  an  electronic  version  of  the  traditional  columnar  work  sheet.  While  all 
spreadsheet  programs  allow  text  entry,  one  line  at  a  time,  a  full-screen  text  editor  or 
word  processor  is  a  valuable  tool  for  adding  paragraph  size  (and  larger)  comments  to 
the  work  papers.  Tabular  data  can  be  added  to  work  papers  in  several  different  ways. 
A  direct  method,  using  an  electronic  spreadsheet,  is  to  establish  the  table  as  a  template 
within  the  spreadsheet  and  then  simply  enter  the  data  in  the  appropriate  rows  and 
columns.  Another  method  is  to  collect  the  data  in  a  database,  using  either  a  filing  or 
database  program.  Then  the  report  writer  module  in  the  database  software  is  used  to 
generate  a  tabular  report  to  add  to  the  work  paper. 

Storage  and  efficient  retrieval  of  work  papers  is  necessary  to  preserve  their 
value,  enhance  their  use  and  serve  as  historical  records.  Traditionally,  work  papers  are 
stored  in  their  paper  form.  The  work  paper  indexing  methods  are  limited  in  their 
cataloging  capability.  Also,  the  hard  copy  work  papers  require  considerable  storage 
space.  Electronic  storage  of  work  papers  can  reduce  storage  space  requirements  since 
several  hundred  pages  of  information  can  be  stored  on  one  5  14  inch  floppy  disk. 
Electronic  indexing  can  provide  a  wider  range  of  cataloging  possibilities  that  can.  in 
turn,  increase  the  efficiency  of  work  paper  retrievals. 


c.  Specific  Programs  For  Generating  Work  Papers 

(1)  Electronic  Spreadsheets.  Electronic  spreadsheet  programs  are 
especially  suited  for  use  in  developing  electronic  work  papers.  Standard  work  paper 
templates  can  be  developed  with  electronic  spreadsheets.  The  advantages  of  templates 
are: 

•  ‘Programmed’  uniformity  can  be  achieved  in  work  paper  format.  The  benefits 
of  programmed  uniformity  are  that  a)  established  guidelines  are  followed  and  b) 
inexperienced  personnel  make  fewer  administrative  mistakes. 

•  Prevent  inadvertent  omission  of  any  required  information 

•  Eliminate  productive  time  wasted  on  clerical  preparation  of  work  paper 

skeletons  K 

•  Makes  clerical  portions  of  audits  faster  and  more  efficient 

•  Allows  easv  modifications  and  additions  of  work  papers.  An  example  of  a  work 
paper  template  is  shown  as  Figure  3.1  in  Appendix  B.  [Ref.  16:  para  202.3. bj 

(2)  Work  Paper  Generators.  Templates  can  be  developed  using  an 
electronic  spreadsheet  program  alone  or  with  an  add-on  program  that  specifically 
generates  work  papers.  There  are  several  automated  work  paper  generators  available 
in  the  commercial  marketplace.  One  such  generator,  that  operates  inside  of  1-2-3  by 
Lotus  Development  Corporation,  is  focus:ABC  by  gemming  Morse, Inc.,  CPAs. 
Hemming  Morse  claims  that  the  productivity  benefits  of  focus:ABC  are: 

•  Reduces  total  engagement  time 

•  Reduces  or  eliminates  paper  and  pencil  entry  by  automating  time-consumine 
clerical  functions 

•  Because  of  ABC's  link  with  Lotus  1-2-3,  ABC  is  fast  and  easy  to  learn 

•  Experienced  Lotus  1-2-3  users  can  create  custom  workpapers  from  ABC  data  or 
modify  and  add  to  the  ABC  worksheets  and  programs 

•  System  flexibility  allows  "what  if  calculations  [Ref.  25] 

Focus:ABC  is  intended  for  use  by  public  accounting  firms  and  is  primarily  designed  for 
audits,  compilations,  reviews,  tax  returns  and  ratio  analysis. 

(3)  Word  Processors.  Microcomputers  significantly  reduce  the  clerical 
efTort  needed  to  develop  and  maintain  work  papers.  A  word  processor,  for  example, 
replaces  the  traditional  "cut  and  paste"  method  of  re-arranging  and  re-writing 
information  by  electronically  moving  blocks  of  text  within  a  document  and  between 
separate  documents.  This  feature  eliminates  the  need  to  retype  entire  documents  just 
to  change  a  few  words  or  paragraphs.  For  auditors,  this  translates  into  labor  hour 
savings  when  developing  and  revising  tables  of  contents,  draft  findings,  checklists  and 
other  documents.  For  example,  word  processors  can  create  and  store  frequently  used 
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documents.  Appendix  C  of  the  Naval  Audit  Service  Handbook  lists  44  standard  audit 
programs  presently  in  use  [Ref.  16:  App  Cj.  Storing  these  audit  programs  as  word 
processed  documents  can  help  reduce  printing  costs.  Rather  than  printing  multiple 
copies  for  routine  distribution,  audit  programs  may  be  distributed  on  floppy  disks  and 
printed  whenever  needed.  This  assumes  that  the  Naval  Audit  Service  uses  the  same  (or 
compatible)  word  processors  at  all  of  its  offices. 

With  regard  to  work  paper  storage,  the  GAO  recommends  that  all 
work  papers  be  indexed  and  cross-referenced: 


The  master  index  should  show  the  storage  device  and  location  of  each  storage 
device  and  location  of  each  workpaper.  Tt  should  also  provide  information  on 
the  subject  of  the  worksheet,  its  title  and  the  type  of  file  it  is;  e.g.,  a  LOTUS 
spreadsheet.  It  is  also  very  useful  to  have  an  abstract  of  the  content  of 
important  workpapers  and  to  develop  key  words  to  associate  with  each.  .  .  . 
[Ref.  15:  p.  27]. 


Efficient  recovery  of  electronically  stored  work  papers  requires  electronic  cataloging. 
DISKCAT  is  a  public  domain  catalog  .ng  program  that  is  powerful,  yet  easy  to  use. 
According  to  the  program  documentation,  DISKCAT 


. .  .  file  names,  date  and  size  to  a  catalog  file,  gives  a  disk  its  own  table-of- 
contents  file,  prints  a  file  listing  to  keen  with  each  disk,  deletes  a  disk  from  the 
catalog  file,  displavs  names  of  all  disks  in  the  catalog  alone  with  number  of 
sectors  and  sides  aiid  free  space  remaining  on  each  disk  .  .  .  add  file  category  and 
description,  rename  files  disk,  delete  file,  view  file  contents,  locate  file,  disk  in 
catalog  ....  sorts,  prints  the  catalog  tile;  it  will  compare  two  catalog  files  and 
print  a  comparative  list  showing  differences  and  matching  files  ....  creates  data 
file  in  a  format  that  can  be  read  bv  Lotus  1-2-3.  All  or  part  of  a  catalog  can  be 
sorted  bv  file  name,  disk  name,  file  type,  date  or  file  extension  ....  search  the 
catalog  for  a  specific  file  to  find  which  disk  it  is  on  ...  [Ref.  26:  p.  1] 


Figure  3.2  is  a  sample  of  the  output  from  DISKCAT  for  an  imaginary  set  of  w'ork 
papers  stored  on  floppy  disk.  DISKCAT  reads  the  floppy  disk,  itself.  This  ensures 
that  no  file  on  the  diskette  will  be  mis$ed. 

2.  Spreadsheets  and  Analysis 

a.  Introduction  to  Spreadsheets  and  Analysis 

Spreadsheet  programs  provide  electronic  versions  of  the  accountant  s 
columnar  pad.  "Virtually  any  audit  task  for  which  pencil,  paper,  and  a  calculator  are 
required  can  be  done  on  an  electronic  spreadsheet  package."  [Ref.  27:  p.  4]  The 
usefulness  of  electronic  spreadsheet  programs  lies  in  their  ability  to  quickly  and 
accurately  calculate  formulas  after  numbers  are  entered  into  the  rows  and  columns 
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[Ref.  28:  pp.  777-786],  The  result  is  an  instant  display  of  the  effect  of  different  data  on 
the  outcome  of  the  analysis.  "What-if'  analysis  can  consider  all  possibilities  within 
minutes.  This  increases  auditor  productivity  by  reducing  manual  duplication  of  data 
into  different  spreadsheets.  The  spreadsheets  can  be  saved,  retrieved  and  re-used  an 
indefinite  number  of  times.  This  makes  them  valuable,  time-saving  tools  for  frequent 
tasks.  All  spreadsheet  programs  perform  the  basic  mathematical  functions  of  addition, 
subtraction,  multiplication  and  division.  The  more  advanced  spreadsheets  have  library 
functions  such  as  summations,  averages,  record  counts,  logarithms,  roots,  powers, 
statistical  analysis,  regression  analysis  and  currency  formatting.  Also,  editing 
commands  are  included  for  revising  the  spreadsheet  format.  The  most  advanced 
spreadsheet  programs  on  the  market  can  import  files  created  by  database  and  word 
processing  programs  and  have  graphics  routines  to  enable  graphic  display  of  the  data. 
[Ref.  29:  pp.  76-77] 

b.  Audit  Procedures  Using  Spreadsheet  Analysis 

Numerical  analysis  is  officially  required  by  Naval  Audit  Service  regulations 
as  financial  profiles  in  section  A  of  "blue  cover"  audit  reports  [Ref.  16:  para  610-7a.3.a]. 
In  addition  to  financial  profiles,  virtually  all  exhibits  summarizing  numerical  data  lend 
themselves  to  spreadsheet  formats.  These  include  operations  summaries  [Ref.  16:  App 
JJ],  disbursing  reviews,  welfare  and  recreation  fund  analysis,  inventory  analysis,  travel 
expense  summaries,  efficiency  audits,  trend  analysis,  and  sensitivity  analysis.  Figure  3.3 
is  the  electronic  spreadsheet  version  of  the  financial  profile  shown  in  the  Naval  Audit 
Service  handbook  [Ref.  16:  App  II j.  The  auditor  simply  inserts  the  descriptive  titles 
and  amounts  onto  the  template  spreadsheet  and  in  seconds  obtains  a  correctly 
calculated  profile.  The  original  template  is  preserved  by  re-naming  the  finished  profile 
before  saving  it  to  disk.  The  template  is  re-usable  and  saves  time  in  preparing  the 
financial  profile  and  computing  totals.  The  same  display  is  shown  for  the  operations 
summary  from  the  Naval  Audit  Service  handbook,  App  JJ  in  Figure  3.4.  A  template 
for  summarizing  cash  counts  during  a  disbursing  office  audit  is  shown  in  Figure  3.5. 
The  Disbursing  Officer's  cash  management  performance  can  be  measured  objectively 
with  the  aid  of  an  electronic  spreadsheet.  For  example,  the  spreadsheet  may  be  used  to 
compute  cash  requirements  for  the  past  year  and  then  compare  actual  cash  on-hand 
against  the  computed  requirements.  Any  significant  deficiency  or  excess  cash-on-hand 
compared  to  the  required  amount  will  be  immediately  obvious  in  the  dollar  and 
percentage  differences. 
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c.  Specific  Programs 

(l)  1-2-3.  1-2-3  by  Lotus  Development  Corporation  is  an  extremely 
powerful  commercial  spreadsheet  program  that  GAO  has  adopted  as  the  standard 
GAO  spreadsheet  package.  1-2-3  is  widely  used  in  the  commercial  sector  and  it  is  also 
part  of  the  Naval  Audit  Service  software  library.  The  reliability  of  1-2-3  is  such  that 
GAO  technical  guidance  allows  that: 


When  the .  standard  GAO  spreadsheet  package,  LOTUS  1-2-3,  is  used 

documentation  of  the  proeram  itself  is  not  required.  However . as  for  a 

manually  prepared  spreadsheet,  the  user  should  ciearlv  indicate  what  information 
is  contained  in  each  row  and  column  of  the  spreadsheet,  specify  the  source  of  the 
information,  identify  calculations  performed,  and  list  all  formulas  used  for 
automatic  calculation. 

Much  of  the  information  required  for  good  spreadsheet  documentation  can  be 
entered  directly  onto  the  spreadsheet  itself.  Separate  sections  of  the  spreadsheet 
can  be  used  to  list  data  sources,  describe  the  variables  included,  detail  the 
assumptions  of  the  analysis  and  describe  models  embedded  in  the  spreadsheet. 
Separate  sections  can  be'  devoted  to  information  on  the  preparer,  the  date,  the 
version  of  the  spreadsheet  and  on  other  facets  of  file  management  ....  LOTUS 
permits  the  user  to  list  out  formulas  for  each  cell .  .  .  [Ref.  T5:  p.  29] 


1-2-3  v2.0  has  the  following  spreadsheet  capabilities: 

•  SI 92  rows  "by  256  columns 

•  Functions:  Time,  Financial,  Statistical,  Mathematical,  Logical  and  Special 

•  Windows-horizontal  or  vertical 

•  Titles-horizontal  and/or  vertical 

•  Printout  control-formatted  headers  and  footers,  borders,  margins,  printer  setup, 
page  length  (20-100),  automatic  page  numbering,  and  date  insertion,  single  or 
continuous  feed,  print  to  file  and  print  text  of  formulas 

The  items  in  the  1-2-3  menu  are  selected  using  the  arrow  keys. 
Alternately,  1-2-3  commands  are  available  through  single  keystrokes  for  the 
experienced  user.  1-2-3  is  very  easy  to  use.  The  names  of  the  menu  choices  describe 
their  functions  so  that  they  seem  logical  to  the  user  who  is  not  a  computer  expert.  The 
menu,  error  message  and  border  areas  of  the  display  take  up  only  four  lines  at  the  top, 
one  line  at  the  bottom  and  one  column  on  the  left  side  of  the  screen,  leaving  the  rest 
of  the  display  area  for  entering  data  onto  the  worksheet.  This  results  in  a  highly 
readable  display  and  minimum  delay  when  scrolling  to  portions  of  the  worksheet  that 
lie  beyond  the  current  displayed  portion.  The  blank  worksheet  area  is  uncluttered, 
except  for  the  date  and  time  displayed  on  the  left  corner  of  the  last  line.  Formulas  for 
automatic  calculation  can  be  developed  using  several  methods.  One  method  is  simply 


to  type  the  cell  references  and  operators  into  the  receiving  cell.  A  second  method  is  to 
begin  in  the  receiving  cell  and  move  the  cursor  into  each  referent  cell  inserting  the 
mathematical  operator  or  function  name  into  the  formula.  Cell  references  within  a 
formula  may  be  absolute,  relative  or  a  combination  of  absolute  and  relative.  Absolute 
cell  references  allow  use  of  the  values  of  a  fixed  location  cell  in  a  calculation.  Whereas 
a  relative  cell  reference  permits  the  location  of  the  referenced  cell  to  change  as 
calculations  progress  through  a  series  of  data  entries. 

1-2-3  has  an  extensive  HELP  facility.  The  HELP  resides  in  a  file  which 
is  callable  at  almost  any  time  from  the  main  program  by  pressing  a  special  function 
key.  Information  is  provided  on  these  topics: 

•  Using  the  help  facility 

•  Errors  and  messages 

•  Using  the  help  facility 

•  Error  message  index 

•  Special  keys 

•  Control  panel 

•  .  Modes  and  indicators 

•  Formulas 

•  @  Functions 

•  Cell  formats 

•  Operators 

•  •  Ranges 

•  Pointing  to  ranges 

•  Reentering  ranges 

•  Starting  over 

•  Ending 

•  Moving  the  cell  pointer 

•  Cell  entries 

•  Commands 

•  Command  menus 

•  Column  widths 

•  Macros 

•  Function  keys 

•  Menus  for  file,  range,  and  graph  names 

•  File  names 
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Help  information  is  displayed  one  screen  at  a  time.  More  help  menu  selections  are 
displayed  on  the  lower  portion  of  the  screen  for  information  about  program  functions 
which  are  associated  with  the  current  help  display.  Program  execution  returns  to  the 
exact  point  where  the  HELP  facility  was  invoked.  The  help  screens  are  written  using 
non-technical  language.  They  are  not  a  substitute  for  the  reference  manual,  but  a 
person  who  is  familiar  with  the  operation  of  electronic  spreadsheets,  in  general,  should 
be  able  to  use  all  but  the  most  advanced  functions  with  only  the  help  screens.  Many 
programs  leave  much  to  be  desired  in  the  area  of  error  messages.  1-2-3  handles  errors 
with  detailed  explanations,  but  without  computer  jargon. 

A  special  feature  of  1-2-3  that  gives  1-2-3  powerful  processing 
capabilities  is  the  MACRO.  Any  sequence  of  keystrokes  that  can  be  typed  on  the 
keyboard  can  be  written  down  in  an  unused  area  of  the  worksheet  for  automatic 
execution  by  1-2-3.  Macros  are  capable  of  executing  all  of  the  commands  that  are 
available  to  the  user.  Macros  can  automatically  set  up  a  template,  execute  repetitive 
commands,  prompt  the  user,  display  menus,  check  data  and  spreadsheets  for  error 
conditions,  run  consolidations  of  spreadsheets  into  one  master  spreadsheet,  build 
databases  and  tables,  and  other  functions. 

1-2-3  macros  are  powerful.  But,  they  are  tedious  to  create,  and  time- 
consuming  to  debug.  DataSource  Publishing  Company  markets  a  program  called 
Auto  Mac  which  automates  1-2-3  Macro  writing.  It  is  designed  to  run  within  1-2-3  and 
save  keystrokes  as  the  user  enters  keyboard  commands. 

The  Spreadsheet  Auditor  by  Consumers  Software,  Inc.  is  a  utility 
developed  for  1-2-3  that  checks  formulas  and  cell  references  within  a  1-2-3  worksheet 
for  inconsistencies  such  as  circular  references  and  formula  redundancies.  It  also 
provides  the  capability  to  assign  descriptive  "pop-up"  notes  to  any  individual  cell  in  the 
worksheet. 

(2)  Multi  Plan.  MultiPlan  by  Microsoft,  Inc.  is  another  powerful 
spreadsheet  program.  The  spreadsheet  capacity  is  255  row's  by  63  columns,  but 
maximum  column  width  is  limited  to  32  characters.  MultiPlan  utilizes  standard  day- 
month-year  time  functions  and  standard  boolean  logic  functions.  Unlike  1-2-3, 
MultiPlan  does  not  support  string  manipulation  functions,  unique  table  lookup 
functions,  or  extended  cell  pointer  functions.  However,  MultiPlan  uses  fewer  keystrokes 
to  select  menu  items  than  1-2-3.  Multiple  window  commands,  in  color,  allow  the  user 
to  view  different  areas  of  a  large  worksheet  on  the  screen  simultaneously.  The 
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ascending  or  descending,  multiple-key  sort  function  is  easy  to  use  and  fast.  MultiPlan 
has  linked  spreadsheets;  1-2-3  does  not.  Entering  data  in  one  spreadsheet  causes  all 
spreadsheets  linked  to  the  on-screen  spreadsheet  to  be  automatically  updated.  This 
eliminates  the  possibility  of  incomplete  file  updates  due  to  operator  omission. 
MultiPlan  graphics  are  primitive.  Numbers  are  represented  graphically  by  displaying 
asterisks  across  a  row  within  the  worksheet  as  a  histogram. 

The  dialog  in  MultiPlan  is  menu  based.  Items  are  selected  by  pressing 
the  space  bar  and  [RETURN]  key  or  the  first  letter  of  the  menu  item.  As  in  1-2-3,  sub¬ 
menus  appear  where  further  choices  are  available.  The  dialog  is  simple,  easy  to  use 
and  effective. 

The  screen  display  is  similar  to  1-2-3,  except  that  the  menu  is  located 
at  the  bottom  of  the  screen  along  with  the  prompt  and  data  entry  line.  The  work  area 
occupies  the  rest  of  the  display  area  on  the  screen;  it  is  uncluttered  and  highly  readable. 
The  commands  are  logical  and  contribute  to  the  ease  of  using  MultiPlan,  with  one 
exception.  The  program  does  not  automatically  reset  from  alphabetic  or  numeric  mode 
after  data  entry.  Resetting  the  data  type  becomes  tedious  when  entering  large  amounts 
of  mixed  data  types. 

Formulas  are  developed  by  typing  in  cell  coordinates,  pointing  to  the 
cell  to  be  included  or  using  the  cell  name  directly  in  the  formula.  This  last  option 
increases  the  readability  and  understandability  of  the  formulas  in  the  worksheet.  Also, 
maintenance  effort  for  a  template  whose  formulas  are  written  in  plain  language  is 
significantly  reduced.  For  example,  w’here  other  spreadsheets  require  a  formula  such  as 
"  +  B2-C2",  MultiPlan  allows  "Net  Income  *  Gross  Income  -  Total  Expenses"  as  a 
valid  formula  (assuming  these  are  also  valid  cell  names).  1-2-3  does  not  support  this 
capability. 

MultiPlan's  HELP  facility  is  not  as  extensive  as  that  of  1-2-3.  But,  it  is 
useful  as  a  quick  reference  for  experienced  users.  Error  handling  in  MultiPlan  is 
simple.  However,  although  the  short  phrase  error  messages  are  readable  they  do  not 
adequately  describe  the  problem.  MultiPlan  will  not  allow  illegal  formulas  to  be 
entered  into  a  ceil.  But  illogical  formulas  are  acceptable  and  will  compute  erroneous 
results  for  the  unsuspecting  user.  However,  this  is  also  true  for  1-2-3. 

(3)  CalcStar.  CalcStar  by  MicroPro,  Inc.  is  an  electronic  spreadsheet 
program  patterned  after  VisiCalc,  the  first  widely  used  spreadsheet.  The  worksheet 
capacity  is  255  rows  by  127  columns.  CalcStar's  calculator  functions  are  simple 
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addition,  subtraction,  multiplication,  division,  and  exponentiation,  with  system 
functions  limited  to: 

•  SUM  Sum  values 

•  CNT  Count  values 

•  AVG  Average  values 

•  MAX  Maximum  value 

•  MIN  Minimum  value 

•  SQRT  Square  root 

•  LOG  Logarithm 

•  LN  Natural  logarithm 

•  ABS  Absolute  value 

•  EXP  Exponent 

•  REGR  Regression 

•  PROJ  Projection 

•  DEPD  Dependent  variable  for  REGR 

•  SLOPE  Slope  of  REGR 

Logical  operators  are  <,  >,  - ,  <>,  <-,  >«,  AND,  and  OR.  The  on-screen 
dialog  is  divided  into  three  sections  which  are  top,  middle,  and  bottom  of  the  screen, 
The  menu  of  commands  takes-up  the  first  five  rows  of  the  display  area.  The  first  letter 
of  each  command  is  displayed  twice  to  emphasize  the  input  selection.  Highlighting  the 
first  letter  within  the  command  would  have  provided  the  intended  emphasis  and  saved 
space  along  the  row. 

CalcStar  is  simple  to  use,  but  moving  around  within  the  worksheet 
area  is  awkward.  The  cursor  is  moved  using  the  control  key  and  another  key, 
depending  on  the  desired  direction  of  movement.  Readability  is  good,  but  the  work 
area  is  small  due  to  the  large  amount  of  space  reserved  for  the  dialog  and  the  menu. 
The  display  area  is  limited  to  10  rows,  extendable  to  15  rows.  How'ever.  the  menu 
disappears  when  the  display  area  extends. 

CalcStar  commands  are  limited  in  variety,  but  easy  to  use.  However, 
only  a  single  command  may  reside  in  memory  at  any  one  time.  A  command  not  in 
memory  must  be  read  into  memory  from  the  disk  file  prior  to  execution,  replacing  the 
current  command.  This  disk  access  slows  down  task  accomplishment. 

Formula  development  is  straight  forward  but  requires  care  in  specifying 
cell  addresses  since  CalcStar  does  not  support  pointing  the  cell  pointer  at  the  desired 
cell  or  range  of  cells  during  formula  development. 
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The  on-line  HELP  facility,  like  CalcStar  itself,  is  straightforward  and 
simple-  CalcStar  handles  errors  by  displaying  a  short  (3  to  6  words)  error  message  in 
the  display  area  at  the  bottom  of  the  screen.  The  error  messages  are  plain  but  not  very 
informative.  Even  with  the  user  manual,  the  real  cause  of  the  error  condition  is 
sometimes  difficult  to  determine. 

CalcStar  has  several  special  features  that  enhance  the  basic 
spreadsheet.  First  is  the  CTRL-Z  command  that  sends  the  cursor  to  the  first  column 
of  the  next  row  from  anywhere  in  the  worksheet.  Second,  the  form  control  mode 
allows  the  programmer  to  specify  a  sequence  of  cursor  moves  to  be  executed 
automatically  during  data  entry  in  a  template.  Third,  CalcStar  can  print  output  to  a 
disk  file  in  text  format  for  later  printing  or  importing  to  a  word  processor.  Finally,  a 
utility  provided  with  CalcStar  (CSDUMP.COM)  will  print  the  formulas  and 
specifications  contained  in  each  cell  of  the  spreadsheet. 

(4)  Encorel  Encore!,  by  Ferox  Microsystems,  Inc.,  is  a  mainframe  quality 
financial  modeling  program  for  microcomputers.  It  is  closer  in  form  and  purpose  to  a 
decision  support  system  generator.  As  such,  it  is  more  flexible  than  a  spreadsheet 
program  for  developing  financial  models  and  specific  output  formats  for  those  models. 
Whereas  electronic  spreadsheet  programs  present  the  user  a  blank  worksheet  to  fill-in 
with  formulas  and  other  commands  for  individual  cells,  financial  modeling  programs 
allow  the  user  to  develop  formulas  in  an  English-like  manner,  unrestricted  by  cell 
boundaries. 

,  According  to  the  literature  provided  by  Ferox  Microsystems,  Encore! 
has  the  following  features: 

•  Separation  of  loeic,  reportine,  and  data;  this  allows  repetitive  use  of  logic  and 
report  files  with  an  unhmited,'number  of  different  data  files. 

•  English-like  modeling  language 

•  Following  modeling  commands: 

Arithmetic  operators 

Column  specifiers  (FOR,  COLumn) 

ABSolute  value,  MINimum,  MAXimum,  EXPonent,  LN, 

-  LOGarithm,  POWER 

LEAD,  LAG,  SPREAD  for  shifting  numbers 
Table  lookup 
Indirect  addressing 
INCLUDE  for  linking  logic  files 

58 


Boolean  operators 

-  Conditional  logic  (IF-THEN-ELSE) 

Financial  function  library 

Day/ Date  functions 
Looping 

-  Others 

•  Goal  Seeking;  allows  determining  what  the  required  parameters  must  be  in 
order  to  reach  a  specified  goal. 

•  Full  screen  text  editor 

•  Matrix  manipulation  and  arithmetic 

•  ASCII  files  can  be  interpreted  as  data 

•  Read  and  write  Lotus  1-2-3  worksheet  files 

•  Customized  report  generator 

•  Presentation  quality  graphics  with  a  graphics  editor 

•  Menus  and  on-screen  prompting:  allows  inexperienced  users  to  enter  data  and 
generate  reports  after  a  model  is  developed. 

•  Monte  Carlo  simulation 

A  copy  of  Encore!  was  not  available  for  testing.  Therefore,  it  cannot  be 
evaluated  in  terms  of  ease  of  use,  screen  displays,  HELP  facility  and  error  handling 
solely  on  the  claims  of  Ferox  Microsystems.  However,  Figure  3.6  provides  the  record 
of  a  session  using  Intermediate  Financial  Planning  System  (IFPS),  which  is  a 
mainframe  financial  planning  program  with  features  closely  resembling  those  of 
Encore!. 

The  main  advantage  in  using  a  financial  planning  program  rather  than 
an  electronic  spreadsheet  lies  in  analyzing  large  amounts  of  data  in  complicated 
models.  The  financial  planning  program,  unlike  the  spreadsheet,  is  only  limited  by  the 
memory  capacity  of  the  computer's  hardware,  not  the  worksheet  area  provided  by  the 
electronic  spreadsheet.  Table  3  provides  a  subjective  comparison  of  the  spreadsheet 
programs  presented  above. 


3.  Statistical  Sampling 
a.  Introduction 

Statistical  sampling  is  a  commonly  used  auditing  technique. 

“Statistical  sampling  is  a  tool  which  permits  the  auditor  to  determine  sample 
reliability  and  the  risk  of  his  accepting  it  [Ref.  30:  p.  238].“  Meigs,  Larsen  and  Meigs 
define  five  phases  of  statistical  sampling 

•  Define  the  objectives  and  nature  of  the  test 

•  Determine  the  method  of  sampling  to  be  used 

•  Calculate  the  sample  size 

•  Select  the  sample 

•  Interpret  the  sample  results  [Ref.  30:  p.  239] 

Microcomputers  can  assist  auditors  with  the  last  three  phases.  The  advantage  in  using 
a  statistical  sampling  program  is  that  the  software  overcomes  the  limitation  of 
published  random  number  tables  and  eliminates  extensive  manual  calculations. 


b.  Methods  for  Microcomputer-Based  Statistical  Sampling  in  Auditing 
Microcomputer  software  can  be  used  to  generate  random  numbers,  and 

prepare  interval,  stratified,  or  cluster  samples.  Specific  statistics  can  be  calculated  such 
as  mean,  median,  mode,  standard  deviation,  and  required  sample  size.  The  more 
sophisticated  programs  also  perform  multiple  linear  and  non-linear  regression,  one  and 
two  way  analysis  of  variance,  significance  testing,  and  correlations  of  data  [Ref.  31:  p. 
5],  Further,  some  programs  calculate  projected  error  based  on  the  audit  sample  results, 
permitting  computation  of  an  allowance  for  sampling  risk.  "The  upper  limit  of  the 
possible  deviation  rate  (compliance  tests)  or  the  upper  error  limit  (substantive  tests) 
can  be  automatically  calculated,  and  amounts  can  be  recalculated  at  varying  levels  of 
sampling  risk"  [Ref.  27:  p.  27],  However,  the  AICPA  also  warns  that 

.  . .  caution  must  be  exercised  when  acquiring  sampling  software;  there  is  a 
varietv  of  sampling  methods  and  formulas  -  onlv  some  of  which  are  appropriate 
to  audit  applications.  Certain  software  produces'  results  in  terms  of  a  lower  error 
limit  when  the  auditor  desires  (and  mav  believe  he  or  she  has  computed)  an 
upper  limit.  In  addition  to  ascertaining  whether  the  methods  and  formulas 
emploved  in  a  program  are  appropriate,  the  auditor  should  determine  whether 
the  software  provides  for  the  large  number  of  digits  (that  is,  for  dollar  amounts) 
as  well  as  for  the  stratum  and  population  sizes  that  are  common  to  financial 
audj^t  applications  but  not  to  most  other  areas  in  which  sampling  is  used. 
[Ref.  27:  pp.  27-28] 

c.  Specific  Programs 

(1)  MICROSTAT.  MICROSTAT  by  Ecostat,  Inc.  is  the  statistical 
package  currently  in  use  by  the  Naval  Audit  Service.  Its  main  menu,  showing  the 
program  capabilities,  is  shown  in  Figure  3.7. 

The  dialog  uses  a  combination  of  user-friendly  menus  and  question- 
answer  prompts.  The  software  is  so  easy  to  use  that  anyone  with  a  basic 
understanding  of  statistics  should  be  able  to  use  MICROSTAT  without  the  program 
documentation.  The  only  minor  irritant  is  the  inability  to  return  to  the  main  menu 
from  any  point  in  the  program.  There  are  several  places  where  returning  to  the  main 
menu  is  possible  only  by  rebooting  the  computer.  Two  major  shortcomings  with 
MICROSTAT  are  the  absence  of  a  random  number  generator  and  the  absence  of  a 
routine  to  calculate  sample  size.  A  HELP  facility  is  not  available,  but  it  is  not  needed 
due  to  the  clarity  of  the  menus  and  prompts.  Errors  are  handled  on-screen, 
interactively,  with  easily  understood  error  messages. 


A  special  feature  of  MICROSTAT  is  a  module  that  generates  a  table 
of  probability  distributions  for  eight  different  kinds  of  probabilities-binomial. 
hypergeometric,  poisson,  exponential,  normal,  F-distribution,  student's  t,  and  chi- 
square.  This  allows  the  auditor  to  take  advantage  of  a  range  of  capabilities  in  audit 
sampling. 

(2)  EPISTAT.  EPISTAT  is  a  set  of  statistical  programs,  in  the  public 
domain.  Figure  3.8  is  a  printout  of  the  program  modules.  EPISTAT  has  both  a 
random  sample  generator  and  a  sample  size  calculation  routine.  The  EPISTAT  dialog 
is  a  combination  of  menus  and  interactive  question/ answer.  The  display  is  natural  and 
highly  readable,  on  a  color  monitor.  The  readability  is  severely  degraded  on  a 
monochrome  monitor,  however,  due  to  the  fact  that  the  program  is  written  for  color. 

Error  handling  capabilities  of  the  various  modules  are  only  fair.  For 
example,  choosing  a  numbered  selection  greater  than  the  highest  number  or  lower  than 
the  lowest  number  on  a  menu  re-displays  the  prompt.  But  the  program  does  not  check 
for  input  of  a  letter.  Instead  the  program  defers  to  the  BASIC  language  interpreter  to 
trap  the  input  type  mismatch.  The  same  is  true  for  input  of  any  alphabetic  character 
whenever  numeric  data  is  expected.  Additionally,  the  modules  ungracefully  allow-  the 
BASIC  interpreter  to  crash  the  program  on  input  of  large  numbers  that  overflow'  the 
computer's  arithmetic  registers.  Its  inadequacies  not  withstanding  however,  EPISTAT 
is  a  useful  package. 

(3)  1-2-3.  As  part  of  the  spreadsheet  modeling  capability,  1-2-3  by  Lotus 
Development  can  also  be  used  for  statistical  sampling  and  analysis,  1-2-3  (v2)  has  a 
multiple  regression  function  in  addition  to  the  statistical  functions  in  prior  versions. 
Figure  3.9  is  a  1-2-3  template  that  selects  a  random  dollar-unit  sample  from  a  Poisson- 
probability  distribution.  The  template  in  Figure  3.10  calculates  the  upper  confidence 
bound  for  the  mean  sample  error  for  the  dollar  unit  sample  computed  in  Figure  3.9 
Both  templates  w'ere  developed  by  Willits  and  McCoslin  for  use  with  1-2-3  version  1A, 
however  they  will  run  on  version  2.0.  These  templates  were  developed  for  use  in  the 
"combined-attributes-and- variables  (CAV)"  sampling  technique.  An  in-depth 
discussion  of  dollar-unit-sampling  is  not  provided  in  this  thesis  since  the  objective  is  to 
identify  microcomputer  tools  for  auditors  rather  than  discuss  principles.  For  an  in- 
depth  discussion  see  Willits  and  McCoslin.2  [Ref.  32:  pp.  62-69] 

2It  was  necessarv  to  modifv  the  Willits  and  McCoslin  macro  in  cells  K 1 8  through 
K20  to  correct  a  run-time  sort  error  in  the  spreadsheet.  The  formulas  and  calculations 
developed  by  Willits  and  McCoslin  were  not  changed. 
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The  1-2-3  regression  module  is  flexible  and  extremely  useful.  In  the 
example  in  the  previous  paragraph,  it  is  used  to  project  expected  inventory  validity  as  a 
function  of  the  dollar  value  of  inventory  and  the  number  of  different  stock  numbered 
items  held  in  storage.  Figure  3.11  shows  the  historical  data  and  the  regression  output. 
Figure  3.12  depicts  the  data  graphically.  Audit  teams  using  this  type  of  analysis  could 
spot  unusual  trends  immediately,  and  could  adjust  their  audit  procedures  accordingly. 
[Ref.  33:  pp.  106-110] 

(4)  STATPLAN.  STATPLAN  by  The  Futures  Group,  Inc.  is  a  statistical 
analysis  program  designed  for  use  by  non-statisticians.  STATPLAN  is  capable  of 
performing  the  following  analysis: 

•  Basic  statistics 

•  Correlation  analysis 

•  Analysis  of  variance  (ANOVA) 

•  Multiple  regression  analysis 

•  Auto  correlation  analysis  (analysis  of  seasonality  and  cycles) 

•  Curve  fitting 

•  Exponential  smoothing 

•  Cross  tabulation 

Basic  statistics  includes  the  number  of  data  points,  number  of  valid  data  points,  lowest 
value,  highest  value,  range,  mean,  standard  deviation,  coefficient  of  variation,  skewness, 
kurtosis  and  median.  In  addition,  cross  tabulation  outputs  the  chi-square  statistic,  phi. 
Cramer's  V  and  the  contingency  coefficient. 

The  STATPLAN  dialog  is  menu  driven  and  provides  several 
capabilities  in  addition  to  the  analysis  capabilities  listed  above.  A  portion  of  the  main 
menu  is  reproduced  below: 

1.  ENTER  new  data  from  the  keyboard 

2.  READ  data  from  disk  file 

3.  SAVE  data  now  in  memory  to  disk 

4.  TRANSLATE  data  files  to  or  from  STATPLAN  format 

5.  EDIT  data  now  in  memory 

6.  TRANSFORM  data  now  in  memory 

7.  CREATE  new  data  series  from  mathematical  functions 

8.  DISPLAY  data  in  tabular  or  graphical  form 

9.  ANALYZE  data 
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STATPLAN  can  read  data  files  and  output  from  other  programs.  Also,  it  can  output 
data  into  ASCII  files  for  export  to  any  program  that  can  read  ASCII  files  (e.g., 
WordStar,  MultiMate,  1-2-3,  dBASEIII,  etc.).  Data  entry  from  the  keyboard  is 
performed  within  the  STATPLAN  full-screen  editor.  A  working  copy  of  STATPLAN 
was  not  available  for  testing  and,  therefore  no  comment  is  made  on  the  program's  ease 
of  use  or  other  features.  Table  4  provides  a  subjective  comparison  of  the  statistical 
programs  presented  above. 

TABLE  4 

SUMMARY  OF  COMPARISON  OF  STATISTICAL  PROGRAMS 

MXCROSTAT  EPXSTAT  1-2-3  STATPLAN 

Cost  S150  $35  $450  $99 

HELP  Facility  Usefulness  N/A  N/A  Outstanding  Unknown 

Ease  of  Use  Outstanding  Excellent  Excellent  Unknown 

Power/Sophistication  of  Outstanding  Excellent  Outstanding  unknown 

Available  Algorithms 

Speed  Excellent  Good  Excellent  Unknown 

Efficient  Memory  Use  Excellent  Very  Good  Excellent  unknown 

Note:  Scale  from  -  Outstanding 
Excellent 
Very  Good 
Good 
Poor 

Unknown  (if  software  was  not  tested) 


4.  Report  Generation 
a.  Introduction 

This  section  discusses  microcomputer  report  transmission  methods, 
automated  report  consolidations,  software  designed  to  improve  written 
communications,  and  graphical  report  presentation  techniques. 


b.  Methods 


Naval  Audit  Service  regulations  stipulate  that,  “At  the  same  time  an  audit 
report  is  released  to  the  printer,  the  regional  office  will  telecommunicate  it  to 
NAVAUDSVCHQ  (AL'D-3) . . . "  [Ref.  16:  para  6I3-10J.  The  traditional 
telecommunication  technique  is  page-at-a-time  telecopy  using  facsimile  transmission 
over  the  telephone  network.  This  is  extremely  slow  and  subject  to  telephone  line 
interference  which  could  result  in  garbled  data.  Microcomputer  to  microcomputer  data 
transmission  is  faster  than  telecopy.  In  addition,  microcomputer  transmission  methods 
allow  for  receipt  confirmation  and  re-transmission  of  un-acknowledged  data. 

Consolidating  periodic  reports  into  master  profiles  can  be  labor  intensive 
and  time-consuming,  especially  where  tabulations  and  statistics  are  involved. 
Spreadsheet  and  word  processing  software  is  useful  for  consolidating  standardized, 
reports  such  as  labor  hour  reports  and  submitting  information  for  Staff  Notes  of  the 
Auditor  General  (Ref.  34:  para  5019], 

Graphics  can  increase  readability  and  understandability  of  written  reports. 
Several  programs  for  the  microcomputer  that  produce  professional  looking  charts  and 
presentation  quality  graphs  will  be  discussed. 
c.  Specific  Application  Programs 

(1)  Smartcom.  Smartcom.  by  Hayes  Microcomputer  Products  Inc.,  is  the 
de  facto  standard  by  which  the  microcomputer  industry  measures  the  capabilities  of 
MS-DOS-compatible,  telecommunication  software.  Naves  developed  Smartcom  as  the 
companion  to  its  original,  programmable  modem,  called  Smartmodcm. 

Smartcom  is  a  menu-driven  interface  between  the  user  and  the  modem. 
The  user  commands  the  modem  through  the  Smartcom  software  by  choosing  from  the 
Smartcom  menu  rather  than  through  primitive,  modem-level  commands.  In  addition, 
Smartcom  has  a  programmable  dialing  directors’.  This  dialing  directory’  holds  user- 
entered  telephone  numbers  and  transmission  parameters  that  allow  error-free,  repetitive 
calling  from  the  dialing  menu,  after  the  user  correctly  establishes  the  initial  dialing 
entry.  In  addition  to  originating  a  call,  Smartcom  is  capable  of  automatically  answering 
at  the  same  speed  as  the  incoming  call,  up  to  9600  baud.  Smartcom  also  provides 
ASCII  file-transfer  protocol,  and  Xmodem  protocol  with  error  checking  for  missing 
sequences  of  data. 

The  10-item  main  menu  is  simple  but  effective.  Each  main  menu 
selection  takes  the  user  to  a  sub-menu.  The  submenus  arc  effective  but  not  as  simple  as 
the  main  menu.  A  new  user  of  Smartcom  would  have  to  consult  the  user  manual  prior 
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to  setting  up  initial  parameters  and  using  the  dialing  directory-.  However,  once  a  data 
transmision  is  in  progress,  Smartcom  takes  complete  control.  It  uses  a  status  bar  in  the 
lower  portion  of  the  screen  to  display  the  status  as  the  data  transfer  progresses. 

The  on-line  HELP  facility  is  limited.  It  cannot  be  accessed  while  the 
software  is  in  control  of  the  data  transfer.  However,  the  documentation  in  the  user 
manual  is  sensibly  arranged  and  adequately  covers  every  function  that  Hayes  designed 
Smartcom  to  perform. 

Smartcom  recognizes  errors  from  the  user,  from  the  modem,  and  from 
the  telephone  line.  It  alerts  the  user  to  each  of  these  with  on-screen  error  messages  and 
sound,  if  the  sound  is  toggled  on.  Depending  on  the  nature  of  the  error.  Smartcom 
either  attempts  to  recover  and  retry  or  returns  to  a  default  menu. 

(2)  QModem.  QModem,  written  by  The  Forbin  Project  and  placed  in  the 
public  domain,  is  another  telecommunications  program.  QModem  performs  the  same 
basic  functions  for  the  user  that  Smartcom  performs.  According  to  the  user's  manual, 
"QModem  can  store  phone  numbers  in  a  personal  directory  for  later  recall.  It  will 
handle  a  variety  of  modems  connected  to  the  PC.  Transfer  files  to  other  computers, 
both  micro  and  mainframe,  using  .  .  .  XMODEM  -protocols  .  .  ."  [Ref.  35] 
Additionally,  QModem  allows  the  user  to  employ  the  Xmodem  protocol  with  or 
without  error  checking.  QModem  will  operate  at  any  transmission  rate  up  to  9600 
baud. 


The  main  menu  and  the  HELP  menu  are  contained  in  one  screen. 
Qmodem  has  twenty-eight  single  or  2-keystroke  commands  that  accomplish  the  same 
functions  as  Smartcom's  extensive  menu  system.  QModem  also  allows  manual  or 
automatic  dialing  and  use  of  Hayes  Smartmodem  commands  when  using  a  Hayes- 
compatible  modem. 

Naval  Audit  Service  management  is  concerned  with  the  length  of  time 
required  to  transmit  data  during  microcomputer  to  microcomputer  data  transfers. 
Figure  3.13  and  Figure  3.14  present  the  results  of  a  test  conducted  of  actual  data 
transfers  between  two  microcomputers.  These  transfers  were  performed  in  the 
laboratory  under  ideal  transmission  conditions,  using  a  dedicated  telephone  line.  Two 
IBM-PC's,  both  running  QModem,  and  Hayes  compatible  modems  operating  at  1200 
baud  were  used.  The  storage  media  were  5  1/4  inch  floppy  diskettes.  Stated  in  non¬ 
technical  terms,  the  size  of  a  single  page  word  processed  document  is  approximately 
2,000  bytes;  a  1-2-3  spreadsheet,  10  columns  by  20  rows,  is  approximately  1,700  bytes. 
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Thus,  transmission  time  per  page  is  between  20  and  25  seconds.  Or,  a  30  page 
document  can  be  transmitted  in  approximately  12  minutes.  Microcomputer 
transmission  at  1200  baud  is  approximately  25  times  faster  than  facsimile  transmission 
which  requires  about  ten  minutes  per  page.  Table  5  provides  a  subjective  comparison 
of  the  telecommunication  programs  presented  above. 


TABLE  5 

SUMMARY  OF  COMPARISON  OF  TELECOMMUNICATION 

PROGRAMS 


Saarteom 

ny  .  1 „ 
vplOOM 

Cost 

>100 

>20 

s 

HELP  Facility  Usafulnass 

Poor 

Vary  Good 

1 

Easa  of  Usa 

Excallant 

Outstanding 

PoMar/Sophistication  of 
Availabl*  Algorithms 

Outstanding 

Excellent 

, Spaad 

Vary  Good 

Excallant 

Efficient  Memory  Usa 

Vary  Good 

Excallant 

Not*:  Seal*  fro*  -  Outstanding 
Excellent 
Vary  Good 
Good 
Poor 

Unknown  (if  softwara  was  not  tastad) 


(3)  Telecommunications  und  the  Federal  Data  Encryption  Standard  ( DES ). 
Although  computer  security  was  specifically  excluded  from  the  scope  of  this  thesis,  a 
brief  discussion  of  the  security  of  the  data  itself,  during  transmission,  is  appropriate 
following  the  above  discussion  of  microcomputer  telecommunications. 

While  classified  information  should  not  be  entered  into  a 
microcomputer  unless  the  microcomputer  is  tempest  certified,  information  subject  to 
controls  under  the  Privacy  Act  of  1974,  and  not  classified,  may  be  manipulated  on  a 
microcomputer  that  has  not  been  tempest  certified.  It  may  also  be  sent  over 
telecommunication  lines.  This  information  can  be  safeguarded  adequately  by 


controlled  access  and  other  means  while  it  is  in  the  microcomputer's  memory  or  on  a 
storage  device.  However,  any  information,  once  transmitted  over  a  telephone  line,  is 
subject  to  deliberate  eavesdropping  and  spurious  emanation  from  the  transmission 
medium.  Such  eavesdropping  and  emanations  can  be  outside  the  control  of  the  sender 
or  receiver. 

Several  programs  exist  that  encrypt  unclassified  but  sensitive  data  for 
storage  and  transmission  using  the  DES  developed  by  the  U.S.  Department  of 
Commerce,  National  Bureau  of  Standards.  It  is  noted  here  that,  although  the  DES 
algorithm  is  efficient  and  effective  when  combined  with  password  entry,  the  DES 
implemented  in  software  is  prohibited  for  use  by  Federal  Government  agencies. 
Agencies  must  implement  DES  in  hardware,  i.e.,  through  a  special  microchip. 
[Refs.  36,37,38:  all,  p.  2,  all] 

(4)  Automated  Report  Consolidation  Using  1-2-3.  Spreadsheet  software 
can  be  used  to  automate  the  consolidation  process  for  recurring  reports.  For  example, 
a  master  template  was  developed  with  1-2.-3  version  2.0.  for  labor  hour  reporting.  This 
master  template,  which  was  based  on  the  Bi-Weekly  Time  Report  (XAVALDSVC 
Form  5220.1),  can  be  completed  for  each  auditor.  Then  another  master  template, 
which  was  also  developed  with  1-2-3,  will  combine  each  individual  report,  accumulating 
the  direct  labor  hours  into  a  single  master  report.  If  desired,  graphs,  pie  charts  and 
statistical  analysis  of  the  data  can  also  be  generated  from  this  same  report. 

Figure  3.15  show’s  the  blank,  master  template  for  preparing  the 
individual  Bi-Weekly  Time  Report.  This  electronic  version  is  basically  the  same  as  the 
paper  version  of  the  Bi-Weekly  Time  Report.  The  person  who  is  completing  the  report 
simply  enters  the  appropriate  information  under  each  column  heading  and  saves  the 
completed  report  to  disk.  1-2-3  performs  all  the  required  calculations.  Further,  the 
global  protection  feature  of  1-2-3  is  selectively  enabled,  thereby  preventing  the  user 
from  entering  data  in  cells  which  are  not  designed  for  user-entered  data.  Figure  3.16, 
Figure  3.17,  and  Figure  3.18  are  examples  of  completed  individual  Bi-Weekly  Time 
Reports  which  will  be  consolidated  later. 

Consolidating  information  from  individual  reports  is  tedious,  repetitive, 
and  labor  intensive.  However,  the  macro  facility  in  1-2-3  was  used  in  the  second 
template  to  automate  the  consolidation  task  for  direct  hours.  The  macro  and  the  blank 
consolidated  report  are  shown  in  Figure  3.19.  To  consolidate  individual  Bi-Weekly 
Time  Reports  with  this  macro,  first  copy  all  the  individual  report  files  onto  one  disk,  if 
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possible.  Next  after  initiating  the  macro  worksheet  onto  the  screen,  invoke  the  macro 
by  typing  ALT-B.  The  macro  will  read  data  from  the  file  into  a  scratch  pad  area  of  the 
worksheet.  Respond  to  the  filename  prompt  by  moving  the  pointer  to  the  name  of  the 
file  that  contains  the  individual  labor  hour  report  which  is  to  be  included  in  the 
consolidated  report  and  press  the  [RETURN]  key.  This  file-input  process  may  be 
repeated  until  all  individual  report  files  have  been  included  by  pressing  the  Y  or  N 
keys,  as  appropriate,  in  response  to  the  prompt  "ANY  MORE  FILES  TO  COMBINE? 
(Y-N )."  After  an  "N"  response  the  macro  sorts  the  data  on  the  W,  M  Code  field, 
calculates  sub-totals  by  W/M  Code,  copies  each  sub-total  line  (across  the  entire  two- 
week  reporting  period)  under  the  correct  report  headings,  and  foots  and  crossfoots  the 
direct  labor  hours.  Figure  3.20  shows  the  finished  report.  It  should  be  noted  that  this 
macro  uses  a  large  amount  of  computer  memory  and  640K  of  RAM  was  used  to 
successfully  execute  this  macro.  Further,  this  macro  is  presented  here  only  as  an 
example  of  what  is  possible  with  microcomputer  software.  This  example  could  certainly 
be  improved  upon,  if  put  into  actual  use. 

(5)  Proofreading.  The  Assistant  Directors  identified  proofreading  of  final 
draft  reports  as  a  top  priority  for  the  Audit  Service.  The  traditional  method  of 
proofreading  requires  one  person  to  read  a  document  aloud  while  another  person 
follows  along  using  a  copy  of  the  document  being  read.  This  technique  is  slow  and 
labor  intensive.  The  microcomputer  can  also  be  used  to  proofread  the  final  rough  draft 
and  the  final  smooth  copy  of  a  document.  The  standard  operating  system  software 
supplied  with  MS-DOS  microcomputers  comes  with  a  library  of  utility  programs.  One 
utility,  FILECOMP.EXE,  is  a  program  that  compares  two  files  and  outputs  -i  list  of 
differences  between  the  files.  Thus,  the  proofreader  can  limit  his  concern  to  just  the 
differences.  The  potential  labor  savings  and  increased  accuracy'  and  timeliness  is 
extemelv  high  using  this  technique.  Figure  3.21  is  a  file  containing  an  excerpt  from 
Naval  Audit  Service  program  number  8,  page  B-6.  Figure  3.22  is  the  same  file  with  six 
changes.  Figure  3.23  is  the  output  from  FILECOMP.EXE  with  these  changes: 

•  Paragraph  1,  line  2-conducting  to  controlling 

•  Paragraph  1,  line  4— higher  authority  to  headquarters 

•  Paragraph  2,  line  3-";"  to 

•  Paragraph  2,  line  3— "d"  to  "D"  in  determine 

•  Paragraph  2,  line  7-",’  after  reports  is  deleted 

•  Paragraph  2.  line  1  l-Inspection  to  Inspector 
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This  method  of  proofreading  seems  counterproductive  with  the  short  example  given. 
However,  reducing  larger  proofreading  tasks  to  this  incremental  approach  will  prove 
very  useful.  Exercise  caution  when  using  this  method.  There  are  many  versions  of  this 
utility  program  and  some  will  only  check  for  a  maximum  of  ten  errors;  some  will  limit 
the  size  of  the  files  compared.  There  could  be  other  limitations,  depending  on  the 
version  of  FILECOMP.  Also,  the  utility  has  other  names,  such  as  FC.EXE,  and 
COMP.EXE. 

In  addition  to  file  comparisons,  spell-checking  and  syntax-checking 
software  is  available  to  provide  additional  automation  of  the  proofreading  process. 

(6)  Report  Graphics.  Graphics  can  be  a  useful  addition  to  audit  findings 
and  reports.  Significant  financial  trends  and  complex  relationships  can  be  understood 
easier  using  graphics.  There  are  many  grapliics  programs,  with  different  capabilities, 
available  for  the  microcomputer.  Several  of  these  programs  allow  "free-hand"  drawing, 
make  flowcharts  and  develop  complex  charts  using  combinations  of  graph  types 
superimposed  onto  one  presentation.  And  others  produce  just  simple  XY  graphs  and 
scatterplots.  Chart  by  Microsoft,  Inc.  is  a  sophisticated  program  that  produces  eight 
different  types  of  graphs  and  charts.  It  can  superimpose  several  graphs  of  similar  and 
dissimilar  types  in  several  different  colors  on  the  screen.  Chart  will  accept  input  data 
from  the  keyboard  or  from  disk  files  in  Chart  format.  It  can  also  read  disk  files  created 
by  spreadsheet  and  data  base  programs  such  as  1-2-3  and  dBASE.  The  program  dialog 
is  menu-driven  through  the  keyboard  or  through  a  mouse.  It  is  very  user-friendly  and 
very  easy  to  use.  Demonstration  graphs  (provided  by  Microsoft,  Inc.)  are  shown  in 
Figure  3.24. 

Lotus  1-2-3  graphics  are  more  than  adequate  for  presenting  numerical 
data  in  pictorial  format.  1-2-3  can  also  read  data  from  other  spreadsheets,  databases 
and  ASCII  text  files.  This  thesis  has  previously  discussed  the  features  of  1-2-3  at 
length. 

PC-Graph,  by  Softek  and  available  in  the  public  domain,  is  a  reliable 
program  that  produces  only  line  graphs.  But  these  line  graphs  have  sharply  detailed 
inter-point  connections.  First  time  use  of  PC-Graph  is  confusing  without  the  users 
manual.  However,  one  convenient  feature  of  PC-Graph  is  that  labels  and  text  may  be 
placed  anywhere  on  the  display  area.  Figure  3.25  shows  two  graphs  created  with  PC- 
Graph. 


5.  Internal  Control 
a.  Introduction 

The  current  public  accounting  definition  of  a  system  of  internal  control 
resulted  from  a  1948  report  by  the  Committee  on  Auditing  Procedure  of  the  American 
Institute  of  CPAs  (AICPA),  and  states: 


Internal  control  comprises  the  plan  of  organization  and  all  of  the  coordinate 
methods  and  measures  adopted  within  a  business  to  safeguard  its  assets,  check 
the  accuracy  and  reliability  of  its  accounting  data,  promote  operational  efficiency, 
and  encourage  adherence  to  prescribed  managerial  policies.  This  definition 
possibly  is  broader  than  the  meaning  sometimes  attributed  to  the  term.  It 
recognizes  that  a  "system"  of  internal  control  extends  bevond  those  matters 
which  relate  directly  to  the  functions  of  the  accounting  and  financial 
departments.  [Ref.  39] 


The  AICPA  Statement  on  Auditing  Procedure  No.  29  further  subdivided 
internal  control  into  two  types  of  controls: 


Internal  control,  in  the  broad  sense  includes .  .  .  controls  which  may  be 
characterized  as  either  accounting  or  administrative  as  follows: 

a.  Accounting  controls  comprise  the  plan  of  organization  and  all 
methods  arid  procedures  that  are  concerned  mainlv  with,  and  relate 
directlv  to.  the  safeguarding  of  assets  and  the  reliability  of  the  financial 
records.  They  generally  include  such  controls  as  the  systems  of 
authorization  an<T  approval,  separation  of  duties  concerned  with  record 
keeping  and  accounting  reports  from  those  concerned  with  operations  or 
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b.  Administrative  controls  comprise  the  plan  of  organization  and  all 
methods  and  procedures  that  are  concerned  mainly  with  operational 
efiiciencv  and  adherence  to  managerial  policies  and  usually  relate  only 
indirectly  to  the  financial  records.  They  generally  include  such  controls  as 
statistical  analyses,  time  and  motion  studies,  performance  reports, 
employee  training  programs,  and  quality  controls.  [Ref.  39] 


The  AICPA  professional  standards  for  evaluating  internal  control  systems 
stress  evaluation  of  the  system  from  the  viewpoint  of  the  independent  auditor  and  the 
impact  of  the  auditor's  reliance  on  the  internal  control  system  as  a  basis  for 
determining  the  extent  of  audit  testing.  Audit  testing  will  ultimately  provide  evidence 
for  the  audit  report.  This  internal  approach,  however,  could  fail  to  consider  external 
forces  (primarily  civil  laws  and  government  regulations)  which  might  affect  an 
organization's  operations.  Also,  this  approach  might  not  completely  exploit  the  latent 
potential  for  improved  inputs  to  the  management  decision-making  process  as  that 
process  derives  benefits  from  the  organizational  accounting  system. 


b.  Methods 

The  Department  of  the  Navy  addressed  this  issue  in  a  recent  staff  study  of 
internal  control  systems  within  the  Navy: 


Jhe  conventional  approach  to  internal  control  review  has  far  too  frequentlv 
fallen  .short  in  a  number  of  significant  areas.  Based  upon  an  artificial 
distinction  between  accounting  and  administrative  controls,  and  largely  ignoring 
external,  controls,  the  traditional  reviews  have  often  failed  to  see  the  "total 
picture. .  This  .problem  has  been,  further  compounded  bv  the  fact  that 
conventional  reviews  are  frequentlv  limited  to  one  or  more  segments  of  a  svstem 
(manual  or  automated)  rather  than  the  entire  svstem  itself.  As  a  result, 
recommendations  to  add,  delete,  or  modifv  system  controls  have  sometimes  failed 
to  consider  the  risk  reduction  impact  ot  interacting  controls  operating  within  the 
segments. not  reviewed,  as  well  as  external  controls  existing  outside  the  formal 
organizational  boundaries  ....  (Ref.  40:  p.  6] 

Lastly,  the  traditional  or  convential  (sic)  approach  has  hot  allowed  for  a  readv, 
accross-the-board  cost-benefit  analysis  of  the  merit  of  specific  controls.  For 
example,  control  A  might  not  be  considered  cost  beneficial  because  it  onlv  acts 
upon  one  or  two  rmnor  threats  within  a  particular  system  segment  'being 
reviewed.  However,  the  same  control  might  have  material  impact  within  the 
segments  not  reviewed.  Without  considering  control  A  .in  terms  of  its  total  risk 
reduction  capacity,  incorrect  conclusions  and  resulting  recommendations  can  and 
have  been  reached.  (Ref.  40:  p.  7] 


The  impetus  for  the  above  study  came  from  a  series  of  laws  and  federal  agency 
pronouncements  designed  to  reinforce  internal  controls  across  the  federal  government. 
Among  them  were: 


The  Federal  Managers  Financial  Integrity  Act,  P.L.  97-255  w-hich  amended 
section  1.13  of  the  Accounting  and  Auditing  Act  of  1950,  31  U.S.C.  66a.  This 
law  required  federal  agency  heads  to  report  annuallv  to  the  President  and  the 
Congress  on  the  effectiveness  and  compliance  of  their  internal  control  systems. 


OMB  ,  Circular  A-123,  Internal  Control  Svstems"  revised  Aueust  1983, 
prescribes  policies  and  standards  to.  be  foliowecTbv  departments  and  agencies  in 
establishing.,  maintaining,  evaluating,  improving  and  reporting  on  internal 
controls  in  their  program  and  administrative  activities. 

OMB  "Guidelines  for  the  Evaluation  and  Improvement  of  and  Reporting  on 
Internal  control  Systems  m  the  Federal  Government",  issued  in  December  f982v 
prescribed  guidelines  for  annual  executive  agency  evaluations  of  their  systems  of 
internal  accounting  and  administrative  control. 


•  Comptroller  General  "Standards  for  Internal  Controls  in  the  Federal 
Government  issued  in  1983. 


•  DoD  Internal  Control  Directive,  issued  March  1982.  [Ref.  40:  p.  4] 
c.  Specific  Software 


The  Navy  Accounting  and  Finance  Center  initiated  development  of  a 
microcomputer  program,  written  in  dBASE  III,  that  would  address  the  shortcomings  of 
the  present  methods  of  evaluating  internal  control  systems  in  the  Navy.  This  program 
is  called  Internal  Control  Information  System  (JCJS).  A  synopsis  of  ICIS  follows: 
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ICIS  reviews  typicallv  address  entire  systems  rather  than  mdividual  segments,  and 
provide  well  documented  and  readilv  defensible  answers  as  to  the  aaequacv  and 
cost-effectiveness  of  both  individual  and  overall  svstem  controls ...  .'1C IS 
reviews  develop  and  address  specific  threats,  their  associated  dollar  risks,  and  the 
risk  reduction  achieved  bv  individual  controls  and  networks  of  controls.  This  in 
turn  allows  an  organization  to  be  fullv  cognizant  of  its  maximum  potential 
svstem  exposure,  as  well  as  to  clearlv  demonstrate  reasonable  assurance  that  such 
exposure  has  been  reduced  to  an  acceptable  level. 

ICIS  is  not  a  checklist,  "ves,  no’  tvpe  approach  to  internal  control  evaluation. 
Instead,  listings  of  specific  threats  '(errors  and  irregularities),  and  their  resulting 
maximum  potential  dollar  exposure  are  developed.  Expected  threat  occurrence 
rates  (including  dollar  exposure  or  risk)  are  detemuned,  and  all  mitigating 
controls  (internal  and  external)  and  their  individual  collective  risk  reduction 
capabilitv  are  computed.  The  result  is  a  readilv  understandable  and  clearlv 
documented  series  of  "threat  paths'"  showing  initial  exposure,  risk  reductions 
achieved  bv  specific  controls,  and  a  remaining  untreated  risk  after  all  controls 
have  come  into  play. 

Threats  are  grouped  into  clusters  of  associated  tvpe  errors  and  irregularities,  and 
upon  conclusion  of  the  review  an  overall  chart 'or  matrix  is  developed  to  show 
tne  total  threats  treated  and  risk  reduction  achieved  bv  each  control  “across-the- 
board.'"  This  allows  for  a  simple  cost-benefit  analvsis  of  individual  existing 
controls,  as  well  as  a  method  to  evaluate  the  full  -impact  of  control  additions, 
deletions,  or  modifications  being  considered  by  the  review  team.  [Ref.  40:  p.  7] 


ICIS'  strength  is  that: 


. . .  DON  management  will  be  able  to  clearly  demonstrate: 


a.  Maximum  potential  system  exposure  or  risk. 

b.  Reasonable  assurance  that  this  exposure  has: has  not  been  reduced  to 
acceptable  levels  in  the  most  efficient  and  cost  effective  manner  possible. 

c.  Clearly  documented  and  readilv  reviewable  evidence  as  to  the  degree  with  which 
GAO  general  and  specific  internal  control  standards  "have,  have  not  been  met. 
[Ref.  40:  p.  8] 

Table  6  presents  a  detailed  side-by-side  comparison  between  the 
conventional  and  ICIS  approaches  to  internal  control  review. 


TABLE  6 

ADVANTAGES  OF  ICIS  METHOD  OF  EVALUATING  INTERNAL 

CONTROL  SYSTEMS 


Conventional  ICIS 


Artificial  distinction  between 
accounting  and  administrative 
controls 

Yes 

No 

Entire  system  included  in  review 

No 

Yes 

All  internal  and  external  controls 
fully  considered 

No 

Yes 

Detailed  listing  of  specific  threats 
to  which  the  system  is  exposed 

No 

Yes 

Detailed  listing  of  operating  controls 
quantitative  measurements  ofs 

No 

Yes 

Threat  exposure 

No 

Yes 

likely  occurrence  rates 

No 

Yes 

Risk  reduction  achieved 
by  individual  controls 

No 

Yes 

Uncontrolled  risk 

No 

Yes 

Logical  grouping  of  similar  threats 

.  No 

Yes 

Threat/control  matrices 

No 

Yes 

Total  system-wide  risk  reduction 
capability  by  control 

No 

Yes 

Hell  documented/ readily  defensible 
reasonable  assurance  that  internal 
control  risks  have  been  reduced  to 
an  acceptable  level 

No 

Yes 

Fully  demonstrates  compliance  with  GAO 
internal  control  standards  in  the  most 
effective  and  efficient  manner  possible 

No 

Yes 

[Ref.  40 «  p.  8-9] 

ICIS  is  a  microcomputer  model  for  decision-making  under  conditions  of 
uncertainty.  Although  it  is  powerful  and  innovative,  it  has  two  distinct  weaknesses. 
The  first  weakness  is  in  determining  the  specific  annual  dollar  amount  of  risk 
associated  with  each  identified  threat;  risk  is  defined  as  the  annual  amount  of  dollar 
damages  that  an  activity  could  incur  due  to  uncontrolled  ocurrences  of  the  threat,  for 
example,  deliberate  contract  overpayments  under  a  kickback  scheme.  The  dollar 
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assignment  is  necessarily  heuristic  and  therefore,  speculative.  Unless  the  dollar 
assignment  is  done  realistically,  the  estimated  risk  will  be  useless.  Second,  the  expected 
threat  ocurrence  rate  is  also  based  on  judgements,  and  hence,  it  is  also  highly 
speculative.  These  two  weaknesses  have  the  potential  to  cause  erroneous  results  that 
would  otherwise  be  valid. 

6.  Planning  and  Controlling  Audits 

a.  Risk  Analysis  in  Audit  Selection  and  Execution 

(1)  Introduction.  Naval  Audit  Service  management  identified  effective 
audit  selection  and  planning  as  another  one  of  their  top  priorities.  They  are  interested 
in  ways  that  microcomputers  can  assist  them  in  selecting  audits.  In  particular,  they  are 
concerned  with  audit  prioritization  in  terms  of  people  required  for  the  audit,  and  in 
terms  of  funds  available  to  conduct  the  audit  as  a  function  of  potential  dollar  savings 
to  the  Navy  as  a  result  of  the  audit. 

(2)  Methods.  The  principles  underlying  the  ICIS  program  (that  is, 
decision-making  under  uncertainty)  seem  to  have  potential  for  applications  in  the  audit 
selection  process.  The  Defense  Contract  Audit  Agency  (DCAA)  developed  a 
mainframe  computer  program  prior  to  1979  that  wras  designed  to  help  DCAA  select 
audits  with  the  highest  potential  payoffs.  Payoffs  were  computed  as  contract  savings 
to  the  government  per  audit  hour.  [Ref.  41]  The  DCAA  program  considers  such 
factors  as: 

•  Time  since  last  audit 

•  Scope  of  last  audit 

•  Personnel  hours  required  during  last  audit 

•  Results  of  last  audit 

•  Contractor  response  to  audit  findings 

(3)  Specific  software.  The  Confidence  Factor,  by  Simple  Software,  is  a 
microcomputer  program  that  analyzes  up  to  100  different  alternatives  using  decision 
matrices,  Monte  Carlo  simulation,  decision  tree  analysis,  critical  path  and  linear 
programming  techniques.  This  program  quantifies  subjective  judgements  using  classic 
mathematical  techniques. 

The  dialog  is  completely  menu  driven.  The  user  performs  all  inputs  to 
the  program  through  a  worksheet  displayed  on  the  monitor.  Output  is  available  in 
graph,  chart  and  tabular  format.  The  program  labels  the  best  alternative  according  to 
the  algorithm  employed.  "What-if'  calculations  and  interim  results  are  also  part  of  the 
program. 
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A  HELP  facility  is  available  for  each  algorithm,  but  only  when  the 
cursor  is  flashing.  The  HELP  facility  is  oriented  toward  operation  of  the  program.  It 
is  not  designed  to  instruct  users  in  statistics  or  the  mathematical  methods  underlying 
each  of  the  program's  algorithms.  Therefore,  users  must  have  a  basic  familiarity  with 
statistical  methods  in  order  to  understand  the  required  input,  output,  and  limitations  of 
the  information  provided  by  The  Confidence  Factor. 

A  program  such  as  The  Confidence  Factor  could  be  used 
advantageously  by  the  Naval  Audit  Service  to  select  proposed  audits  during  annual 
audit  planning.  Qualitative  factors  could  be  assigned  numerical  rankings  and  entered 
into  The  Confidence  Factor  along  with  quantitative  factors,  such  as  travel  costs, 
required  number  of  auditor  hours,  and  priority.  Then  output  from  The  Confidence 
Factor  could  be  used,  along  with  management's  judgement,  to  develop  the  annual  audit 
plan.  This  provides  an  objective  and  logical  basis  for  selecting  audits  and  for 
supporting  the  final  audit  plan.  Another  way  such  a  program  could  be  used  is  to  rank 
aspects  of  audit  findings,  such  as  materiality  levels  and  subjective  evaluations  of 
internal:  control.  Such  a  ranking,  combined  with  program  calculations,  could  decrease 
audit  ruk  and  enhance  the  validity  of  the  audit  report. 
b.  Audit  Scheduling  and  Tracking 

(1)  introduction.  'Due  professional  care  is  to  be  used  in  conducting 
audits  .  . .  [Ref.  1 6-.  para  103. l.c]"  The  auditor-in-charge  is  responsible  for  exercising 
due  professional  care  when  conducting  an  audit.  One  of  his  professional 
responsibilities  is  to  assign  specific  dates  to  audit  tasks  and  to  assign  personnel  to 
complete  these  tasks  within  the  specified  times.  Along  with  scheduling,  the  auditor-in- 
charge  must  monitor  the  progress  of  his  auditors  against  the  established  time  schedule. 

(2)  Microcomputer- Based  Methods  for  Audit  Scheduling.  Project 
management  and  scheduling  software  can  be  used  to  assign  and  to  monitor  auditing 
tasks.  There  are  many  programs  available.  The  simplest  of  these  programs  provide  the 
capability  to  assign  personnel,  and  start  and  stop  dates  to  individual  tasks  within  a 
project.  The  program  output  may  be  in  tabular  or  simple  bar  chart  format.  Advanced 
versions  of  project  management  software  use  statistical  methods  to  compute  useful 
planning  information  such  as  earliest  start  and  stop  times,  slack  time,  critical  paths, 
estimated  early  and  late  completion  times,  project  costs,  project  labor  hours  and  other 
management  information. 
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(3)  Specific  Software.  Project  Scheduler,  by  Data  Consulting  Group,  is  a 
simple  project  management  program.  It  displays  simple  projects  in  screen  graphics, 
limited  to  14  tasks  at  one  time.  The  program  displays  data  on  a  daily  basis  and 
indicates  whether  the  data  are  proposed,  non-critical,  firm/  critical  or  completed,  along 
with  a  user-defined  status  code. 

The  dialog  is  menu  and  command  driven,  selectable  at  the  user's 
option.  Project  Scheduler  has  on-line  help  screens,  and  according  to  the  designer,  has 
sophisticated  techniques  to  prevent  data  entry  errors.  And,  although  the  program  is 
simple,  its  advantage  is  that  it  is  effective  for  simple  projects  where  a  more 
sophisticated  program  could  be  cumbersome. 

Harvard  Project  Manager  (HPM),  by  Harvard  Software,  Inc.,  is  a 
sophisticated  program  that  performs  project  scheduling  and  tracking  using  PERT  CPM 
algorithms.  HPM  displays  data  in  three  forms-flowchart  (called  roadmap),  schedule 
(GANTT  chart),  and  calendar;  all  three  displays  are  available  either  on-screen,  or  on 
printed  copy.  HPM  also  includes  a  file  save  and  retrieve  routine  with  a  backup  feature. 
HPM  utilizes  milestones,  nodes  and  tasks  with  the  capability  to  reference  subtasks  in 
other  project  files.,  Each  task  stores  a  60  space  description,  scheduled  and  actual  start 
and  stop  dates,  earliest  and  latest  start  and  stop  dates  calculated  automatically  based 
on  previous  nodes,  planned  duration  and  planned  cost,  and  actual  duration  and  actual 
cost.  Slack  is  computed  for  each  task  and  the  entire  project.  There  are  six  possible 
printed  reports  for  each  project.  The  reports  are  the  roadmap,  schedule  or  GANTT 
chart,  calendar  showing  working  days  and  holidays  during  the  project  lifetime,  detail 
listing  for  each  task,  status  of  each  task  sorted  by  either  responsible  person  or  amount 
of  slack,  and  project  data  formated  and  printed  to  a  file  for  reading  into  database 
programs  or  spreadsheet  programs. 

The  dialog  is  completely  menu  driven,  except  while  in  the  roadmap 
which  uses  a  graphics  cursor  to  move  between  symbols  directly  on  the  flowchart.  For 
experienced  users,  this  exclusive  use  of  menus  could  become  tedious  if  HPM  were  not  a 
relatively  fast  executing  program.  The  program  is  user-friendly  and  easy  to  use.  The 
HELP  facility  is  primitive  to  the  point  of  being  unnecessary. 

Errors  experienced  while  using  the  program  commonly  occurred  in 
assigning  completion  dates  to  tasks  that  were  out  of  sequence  with  prior  tasks  that  had 
to  be  completed  first  or  in  assigning  completion  dates  prior  to  start  dates.  HPM 
verifies  all  task  dates  before  allowing  an  updated  task  to  be  stored  and  displays  an 


error  message,  indicating  the  exact  error,  that  must  be  acknowledged  by  the  user  before 
HPM  proceeds  with  program  execution. 

EMPACT,  by  Applied  Microsystems,  Inc.,  is  another  project 
management  program  that  uses  GANTT  chart  graphics  to  represent  information. 
EMPACT  will  define  a  maximum  of  250  tasks  per  project.  Status  of  the  project  is 
provided  as  a  funtion  of  scheduled  duration  versus  actual  duration  and  includes 
responsibility  and  task  priority.  The  program  automatically  calculates  end  dates  and 
highlights  overdue  tasks.  The  dialog  is  a  spreadsheet  style,  on-screen  editor  that  allows 
modifying  schedules  directly  on  the  GANTT  chart.  Eight  standard  reports  are 
available  with  a  custom  report  generator  included  in  the  program.  HELP  is  available 
on-line.  However,  a  copy  of  the  software  was  not  available  for  review  and  therefore  no 
comment  is  made  on  the  adequacy  of  the  HELP  facility. 

Personal  Computer  Project  Management  (PCPM),  in  the  public 
domain,  "...  is  a  system  of  interactive  programs  for  project  management  using  the 
critical  path  method  [Ref.  42:  p.  1].“  PCPM  considers  holidays,  subcontractors  (this 
could  be  useful  in  multilocation  audits),  cash  flow,  and  slack.  PCPM  can  produce  a 
critical  path  analysis  report,  cash  flow  analysis,  subcontractor  analysis  and  nodal 
analysis.  Reports  can  be  sorted  in  a  variety  of  ways  to  suit  the  user's  desires.  PCPM  is 
written  in  BASIC. 

The  dialog  is  through  interactive  menus.  Figure  3.26  shows  the  PCPM 
main  menu.  However,  if  desired,  the  user  may  generate  input  files  using  a  line  editor 
or  a  word  processor  in  non-document  mode.  The  program  does  not  have  the 
capability  to  display  the  nodes  in  a  window  while  the  user  is  executing  the  various 
program  options.  This  missing  capability  requires  the  user  to  have  a  printed  list  of 
nodes  available  for  reference  while  working  with  the  program.  In  addition,  there  are 
no  on-screen  graphics  to  give  the  user  a  picture  of  the  overall  network. 

PCPM  does  not  have  a  HELP  facility.  But  with  the  user's  manual  in 
hand,  PCPM  is  easy  to  use.  However,  the  sequential  nature  and  the  slow  speed  of  the 
BASIC  interpreter  limits  PCPM's  usefulness  to  projects  with  100  or  less  tasks.  Table  7 
provides  a  subjective  comparison  of  the  project  management  programs  presented 
above. 
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TABLE  7 


SUMMARY  OF  COMPARISON  OF  PROJECT  MANAGEMENT 

PROGRAMS 


HPM 

Cost 

♦395 

HELP  Facility  Usefulness 

Poor 

Ease  of  Usa 

Excellent 

Power/Sophistication  of 
Available  Algorithm 

Outstanding 

Spaad 

Excellent 

Efficient  Memory  Usa 

Outstanding 

PC PM  EMPACT  Project  Scheduler 

♦35  *150  *75 

Poor  Unknown  Unknown 

Very  Good  Unknown  Unknown 
Vary  Good  Unknown  Unknown 

Very  Good  Unknown  Unknown 
Very  Good  Unknown  Unknown 


Note:  Scale  f roe  -  Outstanding 
Excellent 
Very  Good 
Good 
Poor 

Unknown  (if  software  was  not  tested) 


c.  Audit  Announcement  Letters 

e 

(1)  Introduction.  "The  commander  of  the  audited  activity  is  to  be  given 
at  least  30  days  advance  written  notification  of  an  audit ....  Appendix  E  provides  a 
sample  format  for  announcement  of  periodic  audits .  . .  [Ref.  16:  para  403.1]" 

(2)  Microcomputer-Based  Methods  for  Audit  Announcement  Letters.  The 
microcomputer  can  be  used  effectively  to  create  audit  announcement  letters.  There  are 
several  different  methods.  The  two  most  common  methods  use  wordprocessing 
software  and  database  software  to  maintain  a  list  of  commands  and  mailing  addressses 
and  to  automatically  generate  the  form  letters  for  each  command.  Word  processing 
and  database  software  will  be  discussed  in  detail  in  subsequent  sections:  they  are 
introduced  briefly  here  in  conjunction  with  this  discussion  of  audit  planning  tools. 

(3)  Specific  Software.  Wordprocessing  software,  with  a  document  merge 
function,  is  the  most  common  software  used  for  managing  form  letters.  Wordstar  uses 
Mailmerge  and  MultiMate  uses  its  Merge  routine.  Both  will  combine  a  file  of  addresses 
with  a  basic  form  letter  to  produce  individualized  letters  and  envelopes.  Each  program 


has  unique  features  that  distinguish  it  from  the  other  programs.  Mailmerge  will  pause 
at  pre-programmed  places  within  the  letter  and  allow  the  user  to  insert  comments  that 
are  unique  to  a  particular  addressee  but  inappropriate  for  the  general  population  of 
form  letters;  the  result  is  a  personalized  letter,  mass  produced.  The  MultiMate  merge 
function  will  skip  blank  fields,  such  as  those  found  in  address  files  with  extra  lines  for 
corporate  addresses,  when  the  field  is  not  used. 

Maintaining  the  address  file  is  cumbersome  with  a  w'ordprocessor 
whenever  the  file  contains  more  than  50  addresses;  most  word  processors  perform  file 
searches  sequentially.  Sequential  searches  are  slow’  and  inefficient.  Additionally,  word 
processors  do  not  have  data  entry  validation  and  verification  routines.  Database 
programs,  however,  employ  validation  and  edit  checking  routines  and  are  efficient 
address  file  management  tools.  Depending  on  the  particular  database  program 
employed,  the  number  of  addresses  in  the  file  can  be  virtually  unlimited.  After  changes 
to  the  address  file  are  made,  the  database  program  report  generator  can  produce  a  new 
address  file  in  ASCII  text  format  for  importing  into  the  word  processor. 
d.  Audit  Questionnaire 

(1)  Introduction.  Naval  Audit  Service  headquarters  uses  an  audit 
questionnaire  to  obtain  feedback  from  selected  commands  that  are  audited 
[Ref.  16:  para  613.9  &  App  LJ.  This  feedback  is  considered  in  developing  subsequent 
annual  audit  plans. 

(2)  Methods  and  Specific  Software.  Spreadsheet  software,  such  as  Lotus 
1-2-3,  is  useful  for  tabulating,  analyzing,  and  displaying  the  questionnaire  results.  By 
maintaining  the  data  in  tabular  form,  1-2-3  can  run  statistical  analysis  on  the  data,  and 
display  the  data  in  many  different  ways,  including  graphically.  Long-term  and  short¬ 
term  trends  can  be  pin-pointed,  easily. 
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e.  Team  Selection 


(1)  Introduction.  The  Naval  Audit  Service's  stated  objectives  in  assigning 
auditors  to  all  categories  of  audits  are,  in  part: 

a.  Make  each  audit  team  large  enough  to  allow  for  completing  the  audit  within 
the  established  CALDA\  (See  Appendix  A). 

b.  Provide  teams  balanced  as  to  number,  experience,  and  specialized  knowledge 
and  skills— as  related  to  the  complexity  and  type  of  individual  audit  assignments. 

c.  Assure  that  there  is  a  sufficient  number  of  experienced  auditors  on  each  team  to 
provide  required  on-the-job  supervision,  technical  expertise,  and  training  to 
junior  auditors  and  trainees. 

d.  Assign  and  release  auditors  in  increments  needed  to  prevent  unnecessary 
"loading"  at  any  time  during  an  audit. 

e.  Assign  auditors  in  a  manner  that,  over  a  period  of  time,  will  enable  them  to 
receive  a  varietv  of  experience  and  opportunity  commensurate  with  their  abilitv. 
performance,  and  career  needs,  and  the  future  needs  of  NAVAL  DSVC  •  •  • 
[Ref.  16:  para  404.1] 

(2)  Methods  and  Specific  Software.  To  meet  these  objectives,  managers 
could  maintain  records  of  each  auditor's  work  experiences  by  useful  categories,  as  well 
as  by  the  specialized  audit  skills  of  each  auditor.  This  type  of  recording  of  information 
is  easily  handled  by  most  database  programs,  such  as  dBASE  III,  R:base  5000.  PC- File 
III  and  others.  The  manager  may  query  the  data  files  and  extract  reports  listing  those 
auditors  with  the  desired  skills  and  experience.  If  the  database  is  frequently  updated  to 
reflect  the  changing  skills  of  each  auditor,  the  manager  will  be  able  to  make  informed 
audit  assignments  based  on  up-to-date,  documented  skill  rather  than  on  hit-or-miss 
heuristics. 

7.  General  Management  and  Administration  Applications 
a.  Budgeting 

(1)  Introduction.  Travel  funds  to  send  auditors  to  audit  locations  and 
funds  to  hire  and  pay  auditors  salaries  are  the  major  portions  of  the  annual  budget  for 
the  Naval  Audit  Service.  Effectively  allocating  budgeted  funds  and  controlling  the 
expenditure  of  budgeted  funds  during  budget  execution  are  important  aspects  in  the 
accomplishment  of  the  annual  audit  objectives  for  the  Naval  Audit  Service. 

(2)  Microcomputer  Methods  for  Budgeting.  The  microcomputer  can 
manage  and  manipulate  budget  information  quickly  and  accurately.  It  can  present 
budget  information  in  many  different  formats  so  that  each  format  presents  a  unique 
budget  view  to  the  audit  manager  for  decision-making  purposes.  The  audit  manager 
can  prepare  the  initial  budget,  assisted  by  a  microcomputer,  revise  the  budget  as  the 
fiscal  year  progresses,  and  use  the  budget  to  forecast  and  prepare  future  budgets. 
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fiscal  year  progresses,  and  use  the  budget  to  forecast  and  prepare  future  budgets. 
Microcomputers  are  capable  of  calculating,  in  minutes,  wthat  would  take  humans 
hours  (or  even  days)  to  calculate.  Managers  can  harness  the  speed  of  the 
microcomputer  to  quickly  determine  the  effect  of  proposed  changes  in  travel  plans  and 
personnel  on  their  budget. 

The  microcomputer  can  present  budget  data  in  spreadsheet  (i.e., 
tabular)  and  graphic  formats.  Spreadsheet  format  is  useful  for  detailed  analysis  of 
individual  budget  line  items.  Graphic  format  is  useful  for  overviews,  executive 
summaries,  and  highlighting  data  on  the  extreme  end  of  budget  limitations. 

(3)  Specific  Software.  Electronic  spreadsheet  software  is  readily  adaptable 
to  budget  analysis.  Budget  summaries  developed  with  pen  and  paper  are  often  designed 
in  row'  and  column  format.  In  fact,  the  Navy  Comptroller's  standard  budget  summary 
(NAVCOMPT  Form  2179-1)  is  a  columnar  form  with  columns  and  a  row'  for  footing 
and  crossfooting.  This  format  is  easily  converted  from  pen  and  paper  directly  to 
electronic  spreadsheet.  The  advantage  of  an  electronic  spreadsheet  presentation  of 
budget  information  over  the  pen  and  paper  presentation  is  that  managers  can  see  the 
effect  of  budget  changes  on  the  entire  budget  on  the  computer  display  screen  without 
re-wTiting  the  entire  budget  summary.  The  electronic  spreadsheet  can  recalculate  the 
entire  budget  on  a  single  keystroke,  even  for  a  change  in  just  one  amount.  Also,  the 
microcomputer  can  re-draw  graphic  presentations  and  charts  in  a  few  seconds.  Figure 
3.27  shows  an  hypothetical,  monthly  regional  financial  report  prepared  with  Lotus 
1-2-3.  Figure  3.28  show’s  the  information  graphically. 

Management  Control,  by  Fox  and  Geller,  is  a  program  that  can 
analyze  data  produced  by  1-2-3,  MultiPlan,  SuperCalc,  or  build  its  owm  data  files. 
According  to  Fox  and  Geller,  Management  Control: 

•  Manages  5  kinds  of  data:  actual,  budget,  forecast,  last  year,  next  year 

•  Can  use  an  actual  organizational  chart  to  manage  divisions  or  departments 

•  Can  vary  the  assignment  of  the  months  and  quarters  of  the  fiscal  year 

•  Displays,  graphs,  and  explains  budget  variances 

•  Contains  13  pre-programmed  financial  reports,  and  8  kinds  of  color  graphs 

•  Can  perform  3  and  4  dimensional  financial  analysis  [Ref.  43] 

The  program  software  was  not  available  for  testing  and  no  comment  is  made  on  the 
program's  various  features. 
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b.  Organizing  and  Controlling  Work  Assignments 

(1)  Introduction.  Successful  completion  of  any  task  results,  in  part,  from 
proper  planning  and  ensuring  that  personnel  meet  established  deadlines.  This  section 
discusses  how  to  employ  microcomputer  software  to  plan  and  track  the  progress  of 
work  assignments. 

(2)  Microcomputer- Based  Methods  for  Controlling  Work  Assignments.  The 
project  management  software  discussed  in  previous  sections  (i.e.,  HPM,  PCPM,  and 
etc.)  can  be  used  to  manage  audit  assignments.  One  distinct  disadvantage  with  most  of 
these  project  management  software  packages  is  their  lack  of  the  capability  to  produce 
detailed  financial  reports  by  specific  cost  categories  within  the  assignments  of  a 
particular  project.  These  software  packages  also  do  not  track  backlogs  in  a  detailed 
manner.  Nor  do  these  packages  evaluate  team  performance  or  productivity. 

(3)  Specific  Software.  The  Work  Management  System,  by  the  LWFW 
Group,  was  originally  designed  to  meet  the  planning,  scheduling,  cost  reporting,  and 
forecasting  needs  of  state  and  local  governments.  However,  its  design  makes  it  suitable 
for  the  Naval  Audit  Service  to  employ  in  organizing  and  controlling  audit  assignments. 

The  software  can  be  tailored  to  individual  needs.  It  will  generate 
backlog  reports.  The  Naval  Audit  Service  can  use  these  backlog  reports  to  make 
necessary  changes  in  audit  schedules  affected  by  the  backlogs;  and  re-assign  personnel 
to  balance  audit  team  composition. 

The  software  will  allow  estimates  of  audit  costs  to  be  compared  with 
actual  costs  as  the  audit  progresses,  on  a  daily  basis.  The  software  will  generate  cost 
reports  by  type  of  audit,  by  audit  site,  by  individual  auditor,  and  by  major  functions 
within  the  audit.  Detail  distributions  of  labor  hours,  labor  rates,  and  total  costs  are 
standard  applications.  Additionally,  the  software  can  report  on  major  cost  trends. 

The  benefits  from  such  information  are  several.  First,  the  cost  and 
labor  information  can  be  used  to  justify  budgets  and  personnel  hirings  when  matched 
against  annual  audit  plans.  Second,  prioritized  decision-making,  related  to  which  audits 
should  be  performed  and  by  whom,  is  easier  to  make  when  detailed  costs  can  be 
compared  against  a  prioritized  list  of  objectives. 

The  actual  program  was  not  available  for  testing  and,  no  comment  is 
made  on  its  operation.  But,  from  the  claims  of  the  designer,  the  program  is  potentially 
useful  to  the  Naval  Audit  Service.  The  major  disadvantage  of  The  Work  Management 
System  is  its  high  cost-in  excess  of  S3. 000. 
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c.  Word  Processing 

(1)  Introduction.  The  current  policy  in  the  Naval  Audit  Service  is  that 
word  processing  is  not  the  auditor  s  responsibility.  As  such,  the  Naval  Audit  Service 
guides  auditors  away  from  word  processing  as  an  ineffective  use  of  audit  manhours. 
However,  all  auditors  communicate.  The  hallmark  of  a  potentially  good  auditor  is  the 
ability  to  communicate  ideas,  findings,  and  facts  clearly  and  succinctly,  especially  in 
writing.  The  microcomputer  has  the  potential  to  replace  pen  and  paper,  and  thereby 
increase  the  efficient  (and  thus  indirectly,  also  the  effective)  use  of  audit  manhours. 
Certainly,  the  auditor  who  composes  his  thoughts  to  floppy  disk  makes  them  easier  to 
incorporate  in  automated  audit  reports.  Certain  applications  of  word  processing  are 
appropriate  for  auditors  to  perform  themselves,  especially  where  the  auditor  must 
create  a  rough  draft  on  paper  anyway. 

(2)  Methods  for  Utilizing  Word  Processing  in  Audit  Work. 


Word  processing  software  permits  the  auditor  to  eflicientlv  record,  store,  access, 
and  modifv  standardized  audit  correspondence.  For  example,  manv  engagement 
letters  contain  wording  that  recurs  eacn  vear  or  is  applicable  to  a  large  number  of 
audit  clients.  The  auditor  can  easily  and  quicklv  copv  the  standardized  portions 
of  these  letters  and  enter  the  client- specific  portions  to  produce  a  specific 
engagement  letter  ....  Word  processing  simply  allows  the  auditor  to  modifv 
standard  letters  for  particular  client  circumstances  in  an  efficient  manner. 

The  auditor  mav  use  the  microcomputer  to  develop  customized  audit  programs 
for  each  client.  Lsing  word  processing  software,  the  auditor  can  review  a 
standard  audit  program  and  add,  delete,  or  modifv  procedures  according  to 
particular  engagement  needs.  Senior  members  of  the  audit  team  can  quicklv 
modify  the  audit  program  in  response  to  changing  engagement  conditions.  In 
subsequent  vears,  the  program  can  be  updated  more  efficlentlv.  [Ref.  27:  p.  32] 


Although  the  comments  above  are  intended  for  public  accountants,  the  uses  described 
for  word  processing  software  are  directly  applicable  to  the  Naval  Audit  Service. 

Word  processing  software  abounds  in  the  commercial  software 
marketplace.  The  many  different  word  processing  programs  are  targeted  to  different 
users.  There  are  personal,  professional,  corporate,  scientific,  typesetting,  and  most 
recently,  outline  producing  programs.  This  discussion  is  concerned  with  personal, 
professional,  and  corporate  word  processors. 


Corporate  word  processors  are  designed  to  meet  the  needs  of  the  clericallv  staffed 
word  processing  departments  tvpicallv  found  in  large  corporations.  Professional 
word  processors  are  designed  for  professional  writers,  business  analvsts.  executive 
secretaries,  researchers,  and  academics  who  do  tfieir  own  document  creation  and 
editing.  Personal  word  processors  are  meant  for  use  bv  executives  and  other 
occasional  PC  users,  such  as  home  users.  [Ref.  44] 
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(3)  Specific  Software.  Most  of  the  word  processors  on  the  market  as  of 
the  writing  of  this  thesis  have  the  same  or  remarkably  similar  capabilities  and 
functions.  Their  differences  lie  in  the  way  they  accomplish  these  functions.  These  word 
processors  differ  in  speed,  memory  requirements,  handling  of  pages  and  blocks  of  text, 
file  backup  (or  lack  thereof),  spell  checking  capacity,  list  handling  (or  merging),  and 
ability  to  operate  with  a  wide  range  of  printers.  The  ensuing  discussion  will  concentrate 
on  these  differences. 

WordStar,  by  MicroPro  Inc.,  was  the  first  'full-featured'  word 
processor  designed  for  the  microcomputer.  WordStar  was  originally  designed  for  the 
CPM-based  microcomputers  (e.g.,  the  Apple).  Later,  it  was  re-written  to  operate  under 
the  MS-DOS  environment  found  on  IBM  and  compatible  microcomputers.  Although  it 
is  an  early  generation  word  processor,  it  is  still  widely  used.  Its  wide  use  verifies  its 
strong  capabilities  and  popularity. 

Since  WordStar  was  written  for  8-bit,  CPM-based  microcomputers,  it 
is  faster  when  running  on  16-bit,  MSDOS  machines.  In  the  early  days  of  personal  word 
processors,  this  speed  gave  WordStar  an  advantage  over  other  word  processors. 
[Ref.  45]  -v 

WordStar  is  designed  to  run  in  only  64K  bytes  of  RAM.  The  practical 
effect  of  this  is  that  WordStar  works  on  single  pieces  of  documents  in  memory',  rather 
than  wholely  defined  pages  or  entire  documents.  The  advantage  of  this  is  that  the  size 
of  a  document  is  unlimited  by  the  computer's  memory,  since  WordStar  can  swap  pieces 
of  a  document  in  and  out  of  memory  when  needed.  Thus,  the  length  of  a  document  is 
only  limited  by  the  amount  of  external  storage.  External  storage  can  be  extremely 
large- 10,  20,  50,  100  or  more  megabytes. 

WordStar  allows  three  options  for  setting  page  length.  WordStar  will 
automatically  establish  a  page  break,  based  on  the  user-selected  page  length.  Or,  the 
user  may  turn  off  automatic  paging  and  establish  'forced'  page  breaks  wherever  desired 
in  the  document.  And  finally,  WordStar  will  allows  the  user  to  insert  'forced'  page 
breaks  while  automatic  pagination  is  turned  on.  Pages  are  not  treated  as  unique  entities 
in  WordStar.  Therefore,  moving,  copying,  and  rearranging  text  across  pages  is  not 
constrained  by  the  page  boundaries. 

WordStar  handles  block  operations  (i.e.,  move,  copy,  delete,  write)  in  a 
somewhat  awkward  manner.  First,  the  user  marks  the  beginning  and  ending  of  the 
block  of  text  with  block  markers';  then  the  user  executes  the  block  operation.  A  more 
natural  way  to  mark  text  is  by  moving  the  cursor  over  the  text. 
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WordStar  creates  a  back-up  copy  of  every  document  saved  to  external 
storage.  The  back-up,  starting  with  the  second  edition  of  every  document,  is  a  copy  of 
the  edited  version  of  the  document  as  it  existed  before  the  current  changes.  Thus,  if  the 
current  edited  version  of  the  document  is  lost  during  edit  for  any  reason  (e.g.,  power 
loss,  computer  failure,  etc.),  the  user  can  recover  the  document  by  re-starting  the  edit 
session  with  the  back-up.  Only  the  current  changes  will  have  been  lost.  WordStar 
warns  the  user  when  the  external  storage  device  runs  out  of  sufficient  space  to  store 
both  the  document  and  its  back-up. 

A  spelling  checker  is  not  an  integral  part  of  WordStar,  but  SpellStar 
and  CorrectStar  are  available  to  run  inside  of  WordStar.  Different  versions  of 
SpellStar,  which  has  been  superseded  by  CorrectStar,  have  different  numbers  of  words 
in  the  dictionary,  usually  starting  with  20,000  words.  But,  the  user  may  add  and  delete 
w'ords  to  SpellStar  whenever  desired.  CorrectStar  is  a  65,000-word  checker  that  gives 
the  user  several  possible  correct  spellings  whenever  it  encounters  a  spelling  error.  It  is 
much  more  sophisticated  than  SpellStar. 

WordStar  handles  lists  through  MailMerge.  MailMerge  will  print  form 
letters  with  as  many  different  variables  as  the  user  needs.  In  addition,  the  number  of 
form  letters  produced  from  one  file  is  only  limited  by  the  number  of  addressees  in  the 
address  file.  MailMerge  handles  mailing  labels  and  envelopes  in  addition  to  form 
letters.  MailMerge  is  simple  to  learn  and  will  read  list  information  from  files  created  by 
several  different  database  programs,  including  MicroPro's  InfoStar,  PC-File  III, 
dBASE,  and  others.  Alternately,  the  user  can  create  lists  using  WordStar. 

WordStar  is  configured  by  MicroPro  to  run  with  over  a  dozen  common 
printers.  And,  MicroPro  provides  instructions  and  an  installation  program  to  allow  the 
user  to  customize  WordStar  to  operate  with  printers  not  configured  by  MicroPro. 

MultiMate,  by  MultiMate  International  Corp.,  is  based  on  the  Wang 
Professional  word  processing  system.  The  Wang  word  processor  w*as  the  first  word 
processing  software  to  be  widely  used  by  secretaries  and  typing  pools  on  corporate, 
dedicated  word  processing  computers.  Thus,  many  people  who  w'ord- processed  in  their 
daily  work  environments  were  weaned  on  Wang  word  processing.  MultiMate,  like  the 
Wang  program  it  emulates,  is  designed  to  operate  as  closely  as  possible  to  the  way  in 
which  a  secretary  types  and  edits  revised  documents--one  page  at  a  time.  The 
MultiMate  cursor  lags  behind  the  typist  above  speeds  of  30  words  per  minute.  This  is 
annoying  but  does  not  cause  any  data  loss.  [Ref.  46] 


MultiMate  works  with  only  a  single  page  in  memory,  even  though  it 
requires  256K  of  RAM  in  which  to  run.  It  swaps  pages  in  and  out  of  memory  to  move 
between  pages;  this  is  the  way  most  secretaries  work  with  documents.  The  disadvantage 
of  this  is  that  MultiMate  must  perform  a  4  to  5  second  disk  access  per  page.  This  disk 
activity  slows  down  processing  time  with  a  multiplicative  effect  when  editing  between 
many  pages  in  a  document.  The  advantage  is  that  each  page  is  saved  during  even-  disk 
access;  so,  losses  due  to  system  crashes  and  power  failures  are  limited  to  the  current 
page  in  memory.  Block  operations  are  handled  by  moving  the  cursor  across  the  text  to 
be  blocked  before  executing  the  desired  block  command.  [Ref.  46] 

MultiMate's  greatest  weakness  is  its  lack  of  file  back-up  capabilities. 
MultiMate  erases  the  preedit  version  as  each  page  is  edited  and  saved  to  disk. 

MultiMate  has  a  spellchecker  with  an  80,000  word  dictionary  and 
provision  for  adding  more  words  to  a  supplemental  dictionary.  Not  only  does  the 
spellchecker  flag  words  not  in  its  dictionaries,  it  proposes  possible  correct  spellings. 
[Ref.  47:  p.  1S3] 

For  list  ham  *g,  MultiMate  uses  the  Merge  function.  The  Merge 
function  is  difficult  to  use.  The  document  and  the  list  must  be  formatted  precisely  and 
without  errors  or  the  merge  will  fail.  The  list  must  be  in  MultiMate  readable  format. 
MultiMate  will  not  accept  files  created  by  database  programs,  unless  those  files  can  be 
converted  to  MultiMate  format. 

MultiMate  uses  print  driver  files  to  control  printing.  MultiMate 
International  Corp.  provides  driver  files  for  more  than  40  different  makes  and  models 
of  printers.  In  addition  to  these,  the  user  may  build  customized  print  drivers  using  a 
utility  program  provided  with  the  MultiMate  program. 

EasyWriter  is  wTitten  by  Information  Unlimited  Software.  The  best 
that  can  be  said  for  EasyWriter  is  that  it  is  easy  to  use.  Its  speed  is  mediocre,  and  its 
editing  capabilities  are  quite  basic.  Howrever,  EasyWriter  can  easily  fill  any  need  for 
simple  word  processing  of  short  documents,  such  as  single-page  memos.  It  requires 
128K  of  RAM.  This  large  memory  requirement  is  considered  to  be  excessive  in  view  of 
EasyWriter  s  limited  capabilities.  EasyWriter  stores  the  entire  document  in  memory- 
while  editing.  The  maximum  size  of  a  document  depends  on  the  amount  of  RAM 
available.  12SK  of  RAM  will  allow  a  document  approximately  5.000  words  long. 
EasyWriter  defaults  to  54  lines  per  page  with  automatic  page  breaks.  However,  both 
page  length  and  page  breaks  are  variable  as  the  user  desires. 


Block  operations  are  the  same  as  in  other  word  processing  programs, 
except  that  the  block  size  is  limited  to  4,000  characters.  However,  EasyWriter  has  a 
unique  and  sometimes  convenient  undelete'  command.  The  undelete'  permits  recovery 
of  up  to  62  characters  of  deleted  text,  until  the  next  delete  command  is  executed. 
EasyWriter,  unfortunately,  does  not  have  any  file  back-up  capabilities.  It  defers  to  the 
microcomputer's  operating  system  for  file  duplicating  operations.  EasyWriter  does  not 
have  a  spellchecker  or  a  list  manager. 

EasyWriter,  like  MultiMate,  uses  print  drivers  to  support  attached 
printers.  EasyWriter  supplies  print  drivers  for  most  printers.  And  it  also  allows  the  user 
to  build  a  customized  print  driver  for  unsupported  printers. 

Microsoft  Word,  by  Microsoft  Inc.,  is  fast-faster  than  WordStar.  It  is 
unique  in  that  it  allows  using  a  mouse  along  with  the  keyboard,  and  it  can  display  text 
using  graphics.  The  advantage  in  using  a  mouse  is  that  defining  a  block  of  text  and 
using  a  menu  is  .very  fast.  Graphics  display  of  text  lets  the  user  see  the  effect  of  bold 
face  print,  underlining,  italics,  and  other  special  print  features  on  the  monitor,  without 
printing  the  document  to  paper.  In  addition,  the  user  may  write  macros  for  repetitive 
commands  and  special  style  formats  which  must  be  prepared  to  exact  specifications 
(such  as  this  thesis,  for  example)  [Ref.  48]. 

Microsoft  Word  requires  256K  of  memory.  Although  this  is  a  large 
amount  of  memory,  all  editing,  changes,  deletions,  insertions,  and  formatting  are 
performed  in  RAM.  Microsoft  Word  automatically  executes  page  lengths,  format,  and 
breaks,  once  established  by  the  user;  or,  the  user  may  accept  the  defaults.  Block 
operations  are  quick  and  simple,  with  the  blocks  highlighted  in  inverse  video.  File 
backup  is  available  during  edit.  But,  after  the  document  is  saved  to  disk,  the  pre-edit 
document  is  overwritten.  The  only  way  to  have  true  back-up  files  is  to  make  another 
copy  of  the  document  file  on  another  disk.  [Ref.  48] 

The  spellchecker  is  adapted  from  Oasis  Systems'  The  Word  Plus.  It  has 
a  large  dictionary  and  offers  alternative  spellings  for  errors.  The  mail-merge  facility 
offers  conditional  constructs  for  highly  sophisticated  batch  processing.  [Ref.  48] 

Microsoft  Word  currently  supports  all  printers  manufactured  for  use 
with  personal  computers.  Table  8  provides  a  subjective  comparison  of  the  word 
processing  programs  presented  above. 
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TABLE  8 

SUMMARY  OF  COMPARISON  OF  WORD  PROCESSING  PROGRAMS 


WordStar 

MultiMat* 

EasyHriter 

Word 

Cost 

♦135 

♦235 

♦50 

♦300 

HELP  Facility  Usefulness 

Excellent 

Good 

Good 

Excellant 

Ease  of  Use 

Excellent 

Outstanding 

Excellant 

Very  Good 

Power/Sophistication  of 
Available  Algorithm 

Excellent 

Excellant 

Good 

Outstanding 

Speed 

Outstanding  Excellent 

Excellent 

Very  Good 

Efficient  Meeory  Us* 

(Xitstanding  Vary  Good 

Poor 

Outstanding 

Not*:  Seal*  from  -  Outstanding 
Excellent 
Vary  Good 
Good 
Poor 

Unknown  (if  software  was  not  tastad) 


8.  Fixed  Assets  and  Inventory 
a.  Auditing  Fixed  Assets 

(1)  Introduction.  Naval  Audit  Service  reviews  of  fixed  assets  (i.e.,  plant, 
property  and  equipment)  usually  involve  verification  that  the  asset  exists,  that  assets  in 
existence  as  of  the  last  audit  but  no  longer  available  were  removed  according  to  law  or 
regulation,  that  the  assets  are  permanently  marked  as  government  property,  that  >erial 
numbers  are  recorded,  that  records  are  properly  maintained,  and  that  assets  are 
adequately  safeguarded.  The  review  may  also  include  a  verification  of  procurement  and 
receipt  records. 

(2)  Microcomputer- Based  Methods  for  Auditing  Fixed  Assets.  The  review 
process  can  range  in  complexity  and  depth  from  simple  perusal  of  command  records  to 
conducting  physical  inventories  of  assets  and  tracing  those  assets  back  to  their 
procurement  authorizations. 

(3)  Specific  Software.  Electronic  Spreadsheet  programs,  such  as  Lotus 
1-2-3,  are  useful  for  listing  information  collected  during  the  review  process  in  an 
organized  manner. 


Database  programs,  such  as  dBASE  III  Plus,  are  useful  in  establishing 
information  in  databases  which  can  be  used  comparatively  on  successive  audits  of  the 
same  command.  The  database  program,  depending  on  it  sophistication,  can  be  used  to 
query  the  data  for  almost  any  relationship  desired  by  the  auditor. 
b.  Auditing  Inventory 

(1)  Introduction.  The  Navy  maintains  inventories  of  war  materials,  food, 
repair  parts,  and  general  operating  supplies  that  are  valued  in  excess  of  several  billion 
dollars.  Auditing  naval  inventories  is  a  large  responsibility  simply  due  to  the  high 
monetary  value  and  the  great  quantities  of  items  in  the  inventories.  The  microcomputer 
can  be  used  to  reduce  the  tedium  involved  in  the  collection,  analysis,  and  presentation 
of  the  results  of  inventory  audits. 

(2)  Microcomputer- Based  Methods  for  Auditing  Inventory.  One  way  in 
which  microcomputers  can  assist  auditors  during  inventory  audits  is  in  statistical 
sampling  Microcomputer  software  can  select  sample  size  and  sample  population,  and 
record  and  analyze  sample  data.  Statistical  sampling  with  the  micromputer  was 
discussed  previously.  Additionally,  microcomputer  software  can  assist  the  auditor  in 
recording  the  results  in  worksheet  format  that  serves  two  purposes:  ( 1 )  results  are  in  a 
presentation-quality  format,  and  (2). the  microcomputer  can  perform  mathematical  and 
statistical  analysis  on  the  data  as  it  is  entered  on  the  worksheet,  without  additional 
formatting. 

(3)  Specific  Software.  Any  of  the  electronic  spreadsheet  programs  are 
useful  to  the  auditor  during  random  sample  inventory  counts.  In  our  example,  a  Lotus 
1-2-3  template  is  used  to  generate  a  list  of  random  stock  numbers,  in  Navy  Item 
Identification  Number  (NUN)  format.  The  template  contains  a  macro  to  generate  the 
NUN'S.  In  addition,  the  template  is  set  up  in  w’ork  paper  format  ready  for  the  auditor 
to  enter  his  findings.  After  entering  all  his  findings,  the  auditor  executes  the 
spreadsheet  calculate  command;  the  computer  calculates  the  statistical  analysis  in  a  few’ 
seconds,  and  produces  the  numerical  output  show’n  in  Figure  3.29  and  the  graph  shown 
in  Figure  3.30. 


3Note  the  difference  between  the  two  spellings  data  base  and  database.  Data  base 
represents  a  collection  of  data.  Whereas,  database  represents  the  technology 
surrounding  the  storage,  retrieval,  and  manipulation  of  the  data  in  the  data  base. 


9.  Database 

a.  Introduction  to  Database 

A  data'base  is  a  collection  of  information.  The  information  usually  is 
interrelated,  though  this  is  not  a  requirement.  Database  software  exists  to  make  storing 
and  using  information  easy,  efficient,  and  helpful. 

Database  software  exists  in  two  varieties  for  the  microcomputer--as  a  file 
manager,  and  as  a  relational  database  manager.  A  file  manager  can  only  work  with  one 
file  at  a  time.  This  limitation  is  overcome  in  a  relational  database  manager.  The 
relational  database  manager  is  capable  of  using  information  from  multiple  files, 
concurrently.  [Ref.  49:  pp.  4-5 j 

Database  programs  are  useful  whenever  data  must  be  collected  and  stored 
for  later  use.  The  applications  for  database  software  are  limited  only  by  the 
imagination  of  the  user. 

(1)  Microcomputer-Based  Methods  for  Using  Database  Software  in 
Auditing.  Database  software  can  store  names,  addre'sses,  telephone  numbers,  dates, 
notes,  procedures,  lists,  and  any  other  information  which  can  be  translated  into  words, 
numbers,  or  boolean  conditions.  In  one  application,  a  database  program  is  used  to 
maintain  mailing  lists  for  creating  audit  announcement  letters.  Another  application  is 
storing  information  concerning  auditor  experience  and  qualifications.  Still  another 
application  could  store  information  about  audit  findings  and  follow-Up  action  taken  (or 
yet  to  be  taken).  The  database  program,  in  each  of  these  applications,  can  generate 
reports  in  many  different  sequences  providing  the  auditor  with  different  views  of  the 
data  that  he  might  not  be  able  to  get  from  a  manual  collection  of  data,  without 
expending  such  a  great  amount  of  effort  that  the  cost  of  retrieving  the  information 
would  outweigh  the  benefit  of  having  the  information. 

(2)  Specific  Software.  PC-File  III,  by  Buttonware  Inc.,  is  a  simple  and 
easy-to-use,  but  efficient  file  management  program.  Several  versions  exist.  One  version 
is  in  the  public  domain.  Installation  of  the  program  is  uncomplicated;  the  program  can 
be  customized  to  the  user’s  tastes.  The  program's  capabilities,  according  to  the  user 
manual,  are: 

PC-File  is  a  general  purpose  “Data  Base  Manager"  program.  It  is  designed 
specilicallv  lor*casc  of  use.  With  PC-file,  it’s  verv  easv  to  create  and  maintain 
databases’  on  the  computer,  and  to  create  simple  printed  reports  based  on  vour 
data. 

You  can  use  PC- File  for  all  kinds  of  tasks: 

-  Maintain  mailing  lists  and  print  mailing  labels,  1-up  or  multi-up. 

•  Maintain  price  lists, 


-  Maintain  telephone  or  name; address  directories, 

-  Keep  various  types  of  inventory  records, 

•  Build  personnel  databases, 

-  Keep  customer  lists, 

-  Build  and  maintain  databases  to  be  used  by  other  programs,  like  Visicalc, 

Multiplan,  1-2-3,  and  Mailmerge, 

-  and  many  other  tasks  which  only  you  can  dream  up. 


PC-File  will  allow  vou  to  sort  vour  data  into  almost  anv  sequence.  It  allows 
rapid  access  to  anv  record  in  the'  database,  with  a  sophisticated  search  technique 
allowing  comparison  searches  on  anv  field  in  the  record.  For  example,  vou  can 
display  all  emplovees  over  a  certain  age,  or  all  clients  in  a  certain  state,  or  all 
items  that  are  no't  in  a  certain  categorv.  \  ou  can  print  out  reports  from  vour 
database,  listing  all  or  some  of  the  fields,  from  all  or  some  of  the  records,  in 
manv  different  sequences,  with  totals  on  the  numeric  fields.  Reports  can  be  sent 
directlv  to  vour  video  screen,  or  to  any  one  of  many  different  tvpes  of  printers. 
They  can  also  be  sent  to  disk,  for  later  use  with  your  word  processing  programs. 

You  can  create  entire  new  databases  from  existing  databases.  The  new  database 
can  be  in  a  different  format,  and  can  bfc  a  subset  of  the  database  from  which  it 
w’as  "cloned".  New  fields  can  be  added,  old  fields  can  be  deleted,  field  positions 
can  be  rearranged,  and  field  sizes  can  be  lengthened  or  shortened. 

You  can  export  vour  databases  for  use  with  Multiplan,  Visicalc  and  other  "calc" 
programs,  or  to  "MailMerge"  files.  [Ref.  50] 


PC-File  III  has  a  maximum  field  length  of  65  characters,  maximum 
field  name  length  of  12  characters,  maximum  fields  per  database  of  41,  maximum 
record  length  1,430  characters,  maximum  records  per  database  of  10,000,  maximum 
number  of  sort  control  fields  of  10,  and  a  maximum  number  of  compares  for  print 
record  selection  of  10.  "Records  are  added  one  by  one,  each  displayed  separately.  You 
can  then  modify,  delete,  display  one  record  or  browse  through  all,  and  find  records 
through  wildcard,  and  scanning  [Ref.  51]." 

The  PC-File  III  reporting  function  is  a  long  and  cumbersome  process 
of  setting  up  report  formats,  field  selection,  record  criteria  and  other  required 
preparations  [Ref.  51]. 

InfoStar  Plus,  by  MicroPro  International,  is  another  file  management 


program. 


When  vou  bring  up  InfoStar,  a  menu  . .  .  with  five  choices  appears.  After  vou 
select  appropriate  choices  from  first-and-second-level  menus,  vou  can  beem  to 
develop  a  file  input  form  by  entering  information  on  a  blank  screen,  i  ou  denote 
input  fields  bv  tvping  the  underline  character  a  specified  number  of  times  to 
establish  field  width.  6 . . 
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After  voti  ve  created  an  input  form,  vou  must  choose  a  kev  field.  Then  vou  mav 
assign  attributes  to  anv  of  the  fields.  This  feature  allows  Tor  sophistica'ted  data 
entry  procedures  and  error  checking.  ... 

One  of  the  more  sophisticated  error-checking  attributes  is  called  file  verifv.  Here 
you  mav  enter  a  state  abbreviation  such  as  NY  in  a  State  field.  If  vo'u  have 
assigned  a  file  verifv  attribute  to  the  field,  InfoStar  will  automaticallv  check  vour 
entrv  against  a  file 'that  has  state  abbreviations.  To  keep  track  of  anv  attributes 
you  may  have  assigned  to  fields  in  a  record,  you  can  print  them  out. 

Help  screens  are  ubiquitous  in  InfoSiar.  normallv  occupving  the  upper  third  of 
the  screen.  An  thev  are  needed,  too.  at  least  untir  vou  become  verv  familiar  with 
the  product,  because  most  commands  are  control  key  commands. 

Some  of  InfoStar' s  menu  selections,  commands,  and  modes  are  not  as  clear  or 
intuitive  as  thev  could  be.  If  vou  want  to  search  for  a  record,  for  example,  vou 
select  Enter  Da'ta  from  the  menu.  Then  once  the  form  appears,  vou  select  "edit 
scan  M  ask"  to  conduct  vour  record  search.  In  other  parts  of  the  program,  vou 
select  a  command  that  savs  "Save  form  and  boot  operating  svstem",  which 
actually  returns  vou  to  the  menu  from  which  you  started.  Luckifv,  these  examples 
are  not  typical  of  all  the  selections  you  make  with  InfoStar.  ..." 

The  program  can  generate  two  kinds  of  reports:  the  quick  report  and  the  custom 
report.  With  the  quick  report.  InfoStar  does  most  of  the  work;  with  the  custom 
report,  vou  paint  a  lavout  on  the  screen  and  embed  somewthat  crvptic  commands 
similar  to  the  dot  commands  WordStar  uses. 

In  one  sense,  the  report  generator,  like  the  file  manager  part  of  the  program,  has 
sophisticated  capabilities.  It  can  generate  reports  with  fields  from  more  than  one 
file,  for  example.  But  when  P  tried  to  generate  a  simple  report  that  had 
breakpoints  done  a  certain  wav,  the  quick  report  feature  couldn't  handle  it.  and 
the  custom  report  feature  did  so  onlv  with  some  difficulty  on  mv  part .  .  . 


dBASE  III  Plus,  by  Ashton-Tate,  is  a  programmable,  relational 
database  program.  Programabilitv  allows  advanced  users  to  build  a  program  shell 
around  the  data  base.  This  program  shell  manipulates  the  data  base. in  either  the 
interactive  or  batch  mode  fof  unique  applications.  The  program  becomes  the  human's 
surogate  for  repetitious  tasks.  The  program  takes  on  the  responsibility  for  data- 
checking,  editing,  verification,  and  maintenance  of  the  data  base. 


dBASE  III  Plus  has  over  50  different  commands  to  perform  as  many 
operations  on  the  data  base.  Among  its  more  powerful  commands  are  an  interactive 
query,  views  that  establish  relationships  between  files,  catalogs  that  group  files  together 
and  make  file  selection  easier,  expanded  debugging  assistance,  error  trapping,  and 
sophisticated  report  generation.  The  program  includes  a  screen  painter4  and  has  linked 
screens  that  decrease  the  need  to  put  every  data  field  in  a  relationship  on  the  same 
screen--the  result  is  easier  to  read  data  entry  screens  [Ref.  53J. 


4See  Appendix  A  for  a  further  explanation  of  screen  painter. 
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dBASE  III  Plus  dialog  uses  pull-down  menus  (in  the  'Assist'  mode)  for 
every  function;  these  make  beginners  comfortable  using  the  program.  Advanced  users 
may  run  dBASE  III  Plus  entirely  in  the  command  mode,  without  slowing  down  lor 
menu  operations. 

The  HELP  function  is  always  available  by  pressing  the  FI  key  in  Assist 
mode,  or  by  typing  help'  and  the  name  of  the  command  requiring  help.  The  HELP 
displays  are  lengthy  summaries  of  the  instructions  found  in  the  user  manual.  They  are 
quite  adequate,  even  for  beginners. 

dBASE  III  Plus  was  used  to  develop  the  audit  application  library- 
program  discussed  in  Chapter  2.  This  program  will  cross-reference  audit  program  steps 
to  audit  program  number,  specific  audit  type,  and  auditor.  It  was  developed  specifically 
for  this  thesis  to  demonstrate  dBASE  III  Plus'  capabilities. 

R:base  5000,  by  Microrim,  is  another  programmable,  relational 
database  management  program,  with  capabilities  similar  to  dBASE  III  Plus.  A  unique 
feature  is  its  Application  Express'.  This  is  a  menu-driven  utility  for  designing  and 
implementing  database  applications.  The  user  designs  a  menu  then  assigns  tasks  to 
each  menu.  The  Application  Express  then  generates  the  R:base  code  required  to  run 
the  application.  (Ref.  54:  p.  101].  With  its  menu-driven  dialog  and  Application 
Express,  R:base  5000  is  generally  very  easy  to  use.  In  addition  to  the  basic  program. 
R-.base  5000  has  several  peripheral  utilities: 

Clout,  for  example,  is  a  conversational  language  program  that  uses  a  form  of 
artificial  intelligence  and  allows  the  use  of  straightforward  English  commands  to 
access  data  fro'hi  R:base  databases.  In  fact,  the  proeram  not  onlv  comes  with  a 
dictionarv  ol  words  that  it  recognizes,  but  also  allows  users  to  create  special 
dictionaries  for  each  specific  database  created.  Through  this  facilitv,  users  can 
retrieve  data  without  having  to  rememoer  esoteric ''commands:  thev  merelv 
request  information  from  the  program  as  they  would  from  a  person  .  .  . 

Also  available  are  the  Extended  Report  Writer  and  the  Program  Interface.  The 
extended  Report  Writer  ...  is  an  output  formatting  utilitv  that  gives  R:base 
users  extended  capabilities  to  handle  more  complex  reporting  requirements  than 
possible  using  the  normal  R:base  Report  command.  The  Program  Interface  ...  is 
a  librarv  of  routines  that  allow  Pascal  and  Fortran  programs  to  access  R:base 
files  (Ref.  54:  pp.  103-104]. 


The  HELP  screens 


...  are  a  definite  plus,  despite  the  fact  that  thev  are  in  part  deficient.  L  sers  can 
access  anv  one  of  50  help  screens  from  anvwhere  in  the  program:  bv  tvping  Help 
users  are 'presented  with  a  general  help  screen  that  lists  all  50  commands  that 
have  an  accompanving  help  screen,  and  from  there  users  can  easilv  wew  each 
help  screen.  If  users  are  in  the  midst  of  an  operation  and  know  which  command 
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they  need  help  with,  thev  need  only  type  'HELP'  and  the  appropriate  command 
word,  e.g "HELP  DEFINE". 

The  problem  with  the  help  screens  is  that  thev  offer  only  a  basic  explanation  of 
the  R:base  commands  with  just  a  paragraph  devoted  to  each.  Since  users  must 
leave  the  screen  that  they  are  working  with  in  order  to  access  help,  it  would  be  an 
excellent  benefit  if  a  more  thorough  explanation  that  included  real-life  examples 
accompanied  each  help  screen.  [Ref.  54:  p.  108] 

The  error  handling  routines  are  integrated  with  the  HELP  function. 

...  If  a  user  makes  a  mistake  in  the  svntax  of  a  command,  R:ba$e  automatical^ 
brings  up  a  schematic  help  screen  that  displays  the  proper  svntax.  This  saves 
considerable  time  and  energy  [Ref.  54:  p.  108]. 

R:base  5000  special  features  include  a  three  level,  optional  password 
protection  scheme  for  the  database  files. 

3BY5,  by  Softshell  Corporation,  is  public  domain  file  manager  program 
tlnu  emulates  a  3  by  5  card  file.  It  is  a  startlingly  simple  but  highly  effective  file 
manager.  It  includes  a  simple  word  processor,  based  on  MultiMate,  that  makes  data 
entry  almost  effortless.  Like  any  file  management  program,  3BY5  stores,  searches, 
retrieves  and  outputs  data.  Searches  may  be  done  using  multiple  keys.  3BY5  will  also 
read  and  search  any  WordStar,  WordPerfect  or  ASCII  document  files.  A  maximum  of 
4800  characters  are  permitted  in  each  record:  a  card  is  a  record.  The  maximum  number 
of  records  is  limited  only  by  the  size  of  the  disk  used  to  store  the  records. 

The  dialog  is  completely  menu-driven  in  a  manner  similar  to  Lotus 
1-2-3.  3BY5  displays  a  'card'  on  the  screen  into  which  data  are  entered  as  if  creating  a 
document  in  a  word  processor.  The  user  may  display  up  to  3  different  cards'  on  the 
screen  simultaneously.  The  user  may  also  open  (but  only  use  one  at  a  time)  up  to  3 
different  files  and  direct  input  and  output  to  the  desired  card. 

An  on-line  HELP  facility  is  not  available,  but  not  needed.  The  user 
manual  is  complete  and  easy  to  read. 

Simple  programs  have  simple  errors.  Simple  errors  only  need  smip.c 
error  messages.  3BY5  handles  errors  with  four  to  six  word,  concise  messages  that  i c.r-c 
little  doubt  about  the  error  and  the  required  correction. 

Of  the  many  uses  for  card  files,  we  found  that  3BY5  «j' 
indispensable  for  recording  research  notes.  Notes  can  be  entered  in  an\  \ca..f 
retrieved  later  by  searching  for  a  keyword.  References  can  be  imbedded  wn'ir 
or  written  as  a  separate  record  in  another  file  and  cross-referenced  v  ■ 
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the  auditor,  3BY5  could  be  used  to  make  notes  about  payroll  records  for  which  further 
research  is  required.  Or,  the  auditor  can  write  side  comments  to  be  incorporated  later 
in  his  work  papers.  The  possibilities  are  endless. 

A  special  feature  of  3BY5  is  the  capability  to  define  an  output  file  into 
which  records  from  the  card  files  can  be  output  as  ASCII  text  for  import  into  word 
processors,  electronic  spreadsheets,  and  even  other  database  programs  capable  of 
reading  ASCII  text  files.  Table  9  provides  a  subjective  comparison  of  the  data  base 
programs  presented  above. 

C.  INTEGRATED  SOFTWARE 
l.  Introduction 

Most  software  products  in  use  today  operate  independently  of  each  other. 

This  is  not  a  problem  until  the  user  desires  to  use  the  output  of  one  program  as  the 

input  to  another  program.  Usually,  the  user  finds  himself  re  entering  input.  When 

composing  a  document  that  has  text  and  graphics,  such  as  bar  charts,  the  usual 

method  of  presenting  the  graphics  is  placing  the  graph  on  a  separate  page  as  an 

attachment  to  the  text.  A  better  method  would  be  to  insert  the  chart  directly  into  the 

text  at  the  place  where  the  author  refers  to  the  chart.  Some  families  of  software  allow 

users  to  export  data  or  text  from  one  program  to  another,  such  as  the  MicroPro  family 
•  • 
of  WordStar,  CalcStar,  and  InfoStar.  And  still  other  programs  are  able  to  read  the  files 

and  the  output  of  a  limited  number  of  programs  written  by  other  companies.  Lotus 

1-2-3  can  read  dBASE  III  files  and  any  ASCII  file  by  translating  the  file  to  1-2-3 

format,  for  example.  But  in  all  these  cases,  the  user  must  first  quit  the  program  he  is 

currently  running  before  using  the  other  program  to  read  in  his  data. 
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TABLE  9 

SUMMARY  OF  COMPARISON  OF  DATABASE  PROGRAMS 


PC-Fila 

ZnfoStar 

(BASE  ZXZ 

Ribas* 

3BY5 

Coat 

•31 

•150 

•495 

•495 

N/A 

HELP  Facility  Usafulnaaa 

N/A 

Poor 

Exoallant 

Unknown 

N/A 

Eaaa  of  Us* 

Vary  Good 

Good 

Excellent 

Unknown 

Exoallant 

Power  /Sophistication  of 
Available  Algorithm* 

Vary  Good 

Exoallant 

Outstanding 

Unknown 

Vary  Good 

Sp**d 

Excellent 

Excellant 

Outstanding 

Unknown 

Excellant 

Efficient  Haeory  Us* 

Excellent 

Excellent 

Vary  Good 

Unknown 

Excel lent 

Not*:  Seal*  from  -  Outstanding 
Exoallant 
Vary  Sood 
Good 
Poor 

Unknown  I  if  software  was  not  taatad) 


2.  Software  Methods 

Integrated  software  makes  it  easier  for  the  user  to  quit  one  program  before 
using  another  program.  It  makes  time-consuming,  error-prone  file  translations 
unnecessary  and  permits  integration  of  text,  graphics,  mathematical  computations  in 
one  document.  It  also  allows  the  user  to  have  several  different  programs  running 
concurrently,  i.e.,  wx>rd  processor,  electronic  spreadsheet,  and  database  manager  all  in 
one  program.  The  end  result  is  that  by  employing  an  integrated  software  package  the 
user  may  accomplish  in  one  program  what  heretofore  required  the  use  of  four  or  five 
different  programs.  This  program  consolidation  increases  efficiency  and  reduces 
expended  labor. 

The  cost  advantage  of  integrated  software  over  non-integrated  software  is  very 
favorable.  The  cost  to  buy  all  of  the  separate,  non-integrated  programs  that  are 
contained  in  one  integrated  program  approaches  three  times  the  cost  of  one  integrated 
program. 
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3.  Specific  Software 

a.  Framework  II 

Framework  II,  by  Ashton-Tate,  is  an  extremely  powerful  integrated 
software  program  that  combines  word  processing  (with  an  80,000  word  spellchecker, 
and  mailmerge).  file  management,  electronic  spreadsheet,  graphics  (multiple  colors,  hi- 
lo-close  graph,  bar,  stacked  bar,  line,  scatter,  x-y,  and  pie  charts),  outlining  program 
('idea  processor),  a  programming  language  (called  'Fred'),  a  full-feature 
telecommunications  program  that  includes  X Modem  file  transfer  protocol  and  terminal 
emulation,  file  import  and  export  capabilities  for  WordStar,  MultiMate  IBM 
DCA/Displaywrite,  Lotus  1-2-3,  ASCII,  dBASE  and  others.  All  of  these  functions  are 
available  to  the  user  in  a  single  program.  The  user  does  not  have  to  change  programs. 

b.  Symphony 

Symphony,  by  Lotus  Development  Corporation,  is  another  integrated 
software  package  that  combines  word  processing,  electronic  spreadsheet,  graphics,  and 
database  management  into  a  single  program.  Its  capabilities  are  strikingly  similar  to 
those  of  Framework  II. 

D.  MISCELLANEOUS  USEFUL  SOFTWARE 
*  1.  Forms  Management 

a.  Introduction 

Every  government  employee  uses  some  kind  of  form  during  his  government 
service.  Many  government  offices  create  localized  forms  for  their  own  peculiar 
applications.  Often,  local  forms  go  through  many  revisions  before  they  become  truly 
useful.  Forms  management  software  can  ease  the  time  and  effort  expended  in 
developing  and  maintaining  these  forms. 

b.  Methods 

Word  processors  and  electronic  spreadsheets  are  useful  for  forms 
management.  However,  there  are  several  programs  that  are  designed  especially  for 
forms  management  tasks. 

c.  Specific  Software 

EZ-Forms,  by  MaeDae  Enterprises,  is  a  public  domain  program  that 
generates  customized  master  forms.  EZ-Forms  will  create  or  revise  and  then  print 
forms  for  mass  duplication  by  the  local  print  shop.  Also,  EZ-Forms  allows  the  user  to 
recall  a  master  form  for  an  indefinite  number  of  times,  enter  information  in  the  blanks. 
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and  store  the  form  as  a  completed  form.  EZ-Forms  supports  IBM-compatible,  Epson, 
and  many  daisy  wheel  printers. 

The  advantage  of  EZ-Forms  over  a  standard  word  processor  is  in  the  way 
EZ-Forms  handles  lines,  blocks,  and  pages  of  material.  EZ-Forms  draws  lines,  boxes, 
and  borders  using  single  keystrokes;  word  processors  require  each  line  to  be  drawn  by 
single  characters.  Word  processors  draw  boxes  and  borders  awkwardly.  EZ-Forms 
moves  the  screen  by  sections  in  addition  to  moves  by  line,  as  a  word  processor.  This 
sectional  movement  allows  creating  and  editing  boxes  of  information  without  affecting 
other  areas  of  the  form. 

EZ-Forms  is  not  a  full-fledge  word  processor.  But  due  to  its  forms-oriented 
features,  it  is  better  for  forms  maintenance  than  a  full-fledge  word  processor. 

2.  Desk  Top  Manager 

a.  Introduction 

The  traveling  auditor  often  has  a  need  for  an  alarm  clock,  calculator, 
typewriter,  calendar,  phone  book,  and  scratch  paper  for  notes  on  his  desk  while  he 
works. 

b.  Software.  Methods 

Programs  are  available  that  provide  all  these  things  as  part  of  normal 
microcomputer  operations.  These  programs  reside  in  the  microcomputer's  memory  and  ' 
come  out  only  when  the  user  requests  them.  These  programs  hide  in  memory  and  allow 
other  programs  to  run  concurrently;  the  user  does  not  have  to  terminate  the  running  of 
his  application  program  (i.e.,  word  processor,  electronic  spreadsheet,  database 
manager,  etc.)  to  check  his  calendar,  pen  a  small  reminder  note,  or  calculate  a  financial 
ratio.  Nor  does  the  traveling  auditor  have  to  lug  all  of  these  things  with  him  in 
addition  to  his  computer  and  printer. 

c.  Specific  Software 

(1)  Sidekick.  Sidekick,  by  Borland  International  Incorporated,  was  the 
first  practical  desk  organizer.  It  was  originally  designed  for  programmers,  not  clerical 
persons;  its  pop-up  calculator  computes  binary,  and  hexadecimal  in  addition  to 
decimal;  boolean  logic  calculations  are  also  available  as  part  of  the  calculator.  It  has  a 
complete  ASCII  character  translation  table.  It  also  has  a  notepad, 
calendar  appointment  book,  and  an  auto-dialer.  Its  intended  use  notwithstanding. 
Sidekick  is  also  useful  to  clerical  persons. 
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Sidekick  remains  memory-resident,  after  loading,  until  the  user  presses 
the  CTRL-ALT  key  combination.  Sidekick  freezes  the  currently  running  program  and 
displays  its  main  menu,  with  eight  choices,  on  the  screen.  Figure  3.31  shows  the  main 
menu. 

(2)  PC-Deskmate.  PC-Deskmate,  by  Alternative  Decision  Software.  Inc., 
is  in  the  public  domain.  It  is  a  desk  organizer  similar  to  Sidekick,  but  intended  for  use 
in  the  clerical  environment.  As  such,  it  has  several  unique  features  that  can  potentially 
boost  office  productivity. 

PC-Deskmate,  at  the  user's  option,  may  be  loaded  as  memory-resident, 
or  retained  for  use  as  disk-resident.  This  is  useful  if  RAM  space  is  small.  Figure  3.32 
shows  the  main  menu,  the  alarm  clock,  and  the  calculator.  The  alarm  clock  displays 
time,  rings  hourly  chimes,  can  beep  the  computer's  bell,  display  notes  at  preset  times, 
and  automatically  start  programs  at  preset  times.  The  calculator  emulates  an  adding 
machine,  with  a  tape.  The  tape  is  a  useful  reminder  in  the  event  that  the  user  is 
distracted.  The  calendar  will  maintain  multiple  calendars  of  important  dates  and 
appointments.  Multiple  calendars  are  useful  for  tracking  daily  routines  for  more  than 
one  person,  or  for  multi-location  audits.  The  typewriter  emulator  makes  the  printer 
operate  like  an  electric  typewriter,  in  two  modes-character  mode,  or  line  mode.  The 
user  can  set  and  change  margin  and  tabs  quickly  and  accurately;  a  ruler  line  is 
displayed,  on-screen,  under  the  cursor  that  shows  a  one-to-one  correspondence 
between  the  position  of  the  character  on  the  screen  and  the  printed  character  on  the 
printer.  The  typewriter  function  is  extremely  useful  for  occasions  w'hen  a  .w’ord 
processor's  mailmerge  is  too  cumbersome  for  addressing  a  small  number  of  envelopes. 
Figure  3.33  shows  the  typewriter  emulator  screen.  In  addition,  PC-Deskmate  can  be 
configured  for  non-lBMcompatible  printers.  The  memory-resident  version  of  PC- 
Deskmate  is  invoked  by  pressing  the  alt-M  key  combination.  But,  the  user  can  even 
change  this  key  combination  to  suit  his  desires.  A  problem  with  memory-resident 
software  is  that  it  can  be  incompatible  with  other  software. 


100 


IV.  SURVEY  OF  CURRg^£  J}}Q5ft<i8fiy>UTER  USE  BY  AUDIT 


A.  INTRODUCTION 

The  use  of  microcomputers  for  auditing  and  audit  management  tasks  is  a  recent 
development.  Traditionally,  audits  were  performed  manually.  Hardcopy  documents 
were  reviewed  and  workpapers  were  prepared  manually.  Internal  control  procedures 
and  policies  were  reviewed  and  evaluated  by  the  auditor.  Then,  based  on  the  data 
analysis  performed  and  the  auditors'  judgment,  audit  opinions  were  made.  There  were 
some  automated  audit  assist  tools  available.  However,  these  were  limited  to  audit 
retrieval  software  available  for  use  on  mainframe  computers.  These  programs  were 
used  to  manipulate  and  extract  data  from  automated  data  bases.  The  advent  of 
microcomputers  has  not  changed  the  basic  audit  process.  It  has  given  auditors  a  new 
tool  for  performing  these  processes.  The  increased  use  of  microcomputers  for  audit 
and  audit  management  tasks  was  caused  by  several  factors.  These  factors  include  the 
increased  affordability  of  microcomputers,  greater  capabilities  of  the  machines  and  the 
development  of  "user  friendly'  software  programs  for  many  different  tasks. 

The  first  microcomputers  were  introduced  in  the  late  1970's.  However,  the 
growth  in  the  use  of  microcomputers  did  not  begin  until  the  IBM  Corporation 
introduced  the  IBM  PC  in  1981.  These  early  machines  were  expensive  and  could  only 
perform  a  limited  number  of  functions.  They  were  used  mainly  by  scientists  and  data 
processing  professionals.  The  software  products  available  for  these  microcomputers 
were  limited.  However,  in  the  last  two  years  the  microcomputer's  capabilities  have 
significantly  expanded.  At  the  same  time  the  microcomputer's  price  has  dropped 
sharply.  Some  examples  of  this  price  decrease  are  shown  in  Table  10. 

The  cost  in  1981  prices  for  1986's  typically  configured  microcomputer  would  be 
approximately  S8300.  Today  this  microcomputer  would  cost  about  S2000  and  perform 
better  than  earlier  machines.  [Ref.  55]  This  is  one  of  the  reasons  why  microcomputers 
have  spread  into  businesses  and  audit  organizations. 
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PRICE  COMPARISONS  FOR  MICROCOMPUTER  COMPONENTS 


Prices 


Item  1981  1986 

Monochrome  Monitor  8345.00  $  89.00 
Disk  Drive  $570.00  $  85.00 
Cost/Kilobyte  of  Memory  $8.35  $0.35 
Display  &  printer  Card  $335.00  $150.00 


[Ref.  55] 


Another  reason  for  the  increased  use  of  microcomputers  is  the  availability  of 
useful  software.  There  has  been  a  proliferation  of  new  software  products  developed  in 
the  last  two  years.  These  products  are  suitable  for  all  types  of  business  and  audit 
tasks.  In  addition,  these  programs  are  designed  for  use  by  people  who  are  not  data' 
processing  professionals.  The  program  commands  are  a  combination  of  keystrokes  and 
English  words.  The  user  controls  what  the  program  does,  but  not  how  the  program 
performs  its  function.  This  makes  it  easier  to  learn  and  use  these  programs. 

There  are  many  benefits  of  using  microcomputers  in  the  audit  process.  These 
benefits  include  (1)  increased  reliability  of  audit  results,  (2)  ability  to  sample  more  data, 
(3)  standardization  of  audit  procedures  and  presentations,  and  (4)  better  use. of  audit 
resources  in  planning,  performing  and  managing  audits.  While  the  majority  of  auditors 
and  audit  managers  recognize  these  benefits,  there  are  differing  opinions  on  how  to 
achieve  them.  These  differences  include  both  the  methods  of  using  microcomputers 
and  the  audit  areas  that  are  suitable  for  microcomputers. 

Audit  organizations  in  private  industry  and  the  Federal  government  were 
surveyed  on  how  they  used  microcomputers.  The  survey  gathered  data  on 
microcomputer  audit  applications,  software  used,  and  who  used  the  microcomputers. 
The  data  were  analyzed  for  trends  in  microcomputer  usage  by  auditors  and  audit 
managers.  Also,  the  survey  results  were  compared  to  data  gathered  from  Naval  Audit 
Service  on  microcomputer  usage.  From  this  comparison,  potential  microcomputer 
audit  applications  and  methods  of  achieving  them  in  Naval  Audit  Service  were 
identified.  In  addition,  published  survey  results  on  microcomputer  use  in  audit 
organizations  were  reviewed  for  further  data  on  microcomputer  use. 


«•  *lR?lNt/m0f^^E<?0^REN^N4UD,T0RS  ,N  PR,VATE 

1.  Background 

A  survey  questionnaire  was  sent  to  public  accounting  firms,  banks,  other 
private  industry  audit  organizations,  and  Federal  government  audit  groups.  This 
survey  included  background  questions  concerning  the  types  of  audits  performed  and 
audit  procedures.  The  purpose  of  these  questions  was  to  determine  the  similarity  of 
the  respondents'  audit  work  load  to  the  Naval  Audit  Service's  work  load.  Responses 
received  from  audit  organizations  with  a  similar  work  load  would  have  more 
importance  in  the  analysis  of  microcomputer  use.  The  remaining  questions  concerned 
the  use  of  microcomputers  by  the  auditors  and  audit  managers.  These  questions  asked 
what  audit  applications  were  performed  on  microcomputers,  what  types  of  software 
was  used  by  the  organization,  who  was  using  the  microcomputers,  and  where  they  were 
used.  These  questions  identified  potential  areas  of  microcomputer  use  for  the  Naval 
Audit  Service.  Also,  these  questions  identified  the  means  of  achieving  these 
microcomputer  applications.  A  final  question  asked  the  respondents  to  list  other  areas 
of  microcomputer  usage  by  auditors  and  audit  management  they  felt  should  be 
considered  in  this  thesis. 

2.  Methodology 

Potential  survey  respondents  were  selected  from  a  variety  of  companies  and 
Federal  agencies.  The  companies  initially  considered  ivere  involved  in  banking,  public 
accounting,  oil  production,  mining,  manufacturing,  food  processing,  and  a  variety  of 
service  industries.  Initially,  seventy-one  companies  were  judgmentally  selected  on  the 
basis  of  sales  volume  and  number  of  employees.  Thirty-eight  companies  responded  to 
the  initial  contact  letter  and  agreed  to  participate  in  the  survey.  The  Federal  audit 
organizations  were  in  both  Department  of  Defense  (DoD)  and  non-DoD  agencies. 
Five  Federal  audit  organizations  participated  in  the  survey.  A  list  of  the  survey 
participants  is  included  in  Appendix  C.  A  copy  of  the  questionnaire  sent  to  these  audit 
organizations  is  included  in  Appendix  D.  The  purpose  of  the  survey  questions  was  to 
identify  how  other  organizations  used  microcomputers.  Information  gathered  in  the 
survey  could  help  the  Naval  Audit  Service  to  better  utilize  and  manage  its 
microcomputers. 

Percentages  reported  in  the  tables  in  the  following  sections  are  for  all 
respondents  who  answered  the  question.  Also,  separate  percentages  are  included  for 


Federal  audit  organizations.  This  was  done  to  illustrate  the  extent  of  microcomputer 
use  in  other  Federal  agencies  compared  with  the  microcomputer  use  in  the  Naval  Audit 
Service.  Unless  otherwise  noted,  multiple  answers  were  acceptable  for  the  survey 
questions. 

3.  Results 

The  audit  organizations  surveyed  performed  all  types  of  audits.  The 
percentage  of  organizations  that  performed  each  kind  of  audit  are  shown  in  Table  1 1. 


TABLE  11 

TYPES  OF  AUDITS  PERFORMED  BY  RESPONDENTS 

Audit  Types 

Percentage  of  Respondents 

Total 

Federal 

Financial 

93 

60 

Operational 

Special  Studies  Requested 

91 

88 

100 

80 

by  Management 

The  functional  areas  reviewed  in  operational  audits  were  similar  to  those 
reviewed  by  the  Naval  Audit  Service  for  most  organizations.  Table  12  lists  the 
functional  areas  reviewed  by  the  survey  respondents.  Standard  audit  program  usage 
varied  greatly  among  the  respondents.  This  usage  is  one  indication  of  the  amount  of 
repetition  in  an  organization's  audit  work  load.  It  is  easier  to  develop  microcomputer 
applications  and  increase  microcomputer  usage  in  an  organization  when  the  audit  work 
load  is  repetitive.  Table  13  details  audit  program  usage  by  the  survey  respondents. 

As  discussed  in  Chapter  2,  the  Naval  Audit  Service  has  44  standard  audit 
programs  for  use  by  its  auditors.  However,  37%  of  the  audit  work  load  for  fiscal  year 
1986  was  non-recurring  or  special  audits  which  require  development  of  special  audit 
programs.  [Ref.  17]  The  results  of  these  background  questions  indicated  that  the 
survey  respondents  work  load  and  approach  were  similar  to  the  Naval  Audit  Service's. 
Thus,  the  results  from  the  specific  questions  about  microcomputer  usage  are  relevant 
to  the  Audit  Service. 


TABLE  12 

FUNCTIONAL  AREAS  AUDITED  IN  OPERATIONAL  AUDITS 


Functional  Areas 


Percentage  of  Respondents 
Total  Federal 


Payroll 

Supply/Inventory 

Data  Processing 

Disbursement/Bill  Paying 

Fixed  Assets 

Contracting/Procurement 

Cash  Management 

Personnel 

Warehousing 

Maintenance  and  Repair 

Transportation 

Manufacturing  and  Production 

Timekeeping 

Communication 

Budgeting 


TABLE  13 

AUDIT  PROGRAM  USAGE  BY  SURVEY  RESPONDENTS 


Percentage  of  Respondents 


Total 


Federal 


In  what  percentage  of  audit 
applications  are  standard  audit 
programs  used? 


76%  -  1003 
51*  i  -  7  5* 

26-  i  -  50^ 

1%  -  25i 


In  what  percentage  of  audit 
applications  are  unique  audit 
programs  developed? 

76%  -  100% 

51%  -  75% 

26%  -  50% 

1%  -  25% 
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The  next  series  of  questions  concerned  what  types  of  applications 
microcomputers  were  used  for  and  the  types  of  microcomputer  software  used  to 
implement  these  applications.  Respondents  were  given  choices  of  common 
microcomputer  applications  for  performing  audit  and  administrative  tasks.  The  choices 
included  both  simple  applications  such  as  report  writing  and  more  complex 
applications  such  as  graphics  and  telecommunications.  The  number  of  these 
applications  performed  by  the  respondents  varied  from  as  few  as  one  to  all  of  the  listed 
applications  plus  additional  ones  not  listed.  Table  14  shows  the  use  percentages  for 
these  microcomputer  applications. 

TABLE  14 

MICROCOMPUTER  APPLICATIONS  USED  BY  RESPONDENTS 

Applications  Percentage  of  Respondents 

Total  Federal 

86  100 

74  100 

74  80 

70  80 

53  60  * 

49  100 

44  60 

33  60 

19  0 


The  applications  with  higher  usage  percentages  are  the  ones  that  are  the 
easiest  and  most  obvious  to  transfer  from  manual  methods  to  the  microcomputer.  The 
remaining  applications  are  more  complex  and  require  more  experience  with 
microcomputers  to  implement.  There  is  a  learning  curve  associated  with 
microcomputer  technology.  After  auditors  and  audit  managers  become  more 
experienced  microcomputer  users,  they  develop  audit  applications  for  the 
microcomputer  that  are  more  complex  in  operation  and  purpose  than  previous 
microcomputer  audit  applications. 

All  of  the  respondents  used  commercial  software  products  on  their 
microcomputers.  This  is  the  quickest  and  most  reliable  method  for  non-data 


Report  Writing 
Electronic  Workpapers 
Data  Analysis 
Audit  Management 
Statistical  Sampling 
Telecommunication 
Graphics 

Audit  Presentation 
Other 


processing  professionals  to  utilize  microcomputers.  The  software  types  and  inventory 
of  products  used  varied  among  the  respondents.  Virtually  even-  organization  used 
word  processing  and  spreadsheet  software  either  as  a  single  program  or  part  of  an 
integrated  software  program.  Also,  data  base  programs  were  used  by  a  majority  of  the 
organizations.  The  remaining  software  types  were  used  by  less  than  half  of  the 
respondents.  The  trends  in  software  usage  may  be  related  to  the  complexity  of 
microcomputer  application.  The  software  types  used  less  frequently  are  developed  for 
a  specific  problem  or  application.  The  majority  of  users  are  not  sufficiently 
knowledgeable  in  using  the  microcomputer  to  perform  this  task  or  realize  the  need  to 
perform  it.  See  Table  15  for  the  types  of  software  programs  used  by  the  respondents. 


TABLE  15 

SOFTWARE  USED  BY  THE  SURVEY  RESPONDENTS 

Software  Type 

Percentage 

of  Respondents 

Total 

Federal 

Spreadsheet 

91 

100 

Word  Processing 

91 

100 

Data  Base 

65 

80 

Graphics 

49 

80 

Telecommunications 

44 

100 

Utilities 

35 

40 

Integrated  Packages 

30 

60 

Project  Management 

26 

60 

Other 

26 

40 

Statistics 

23 

60 

Accounting 

5 

0 

About  49%  of  the  organizations  developed  custom  audit  programs  using  a 
high  level  programming  language  such  as  COBOL,  BASIC,  or  PASCAL.  These 
programs  were  used  for  downloading  data  from  mainframe  computers,  performing 
random  sampling,  and  budgeting,  among  other  tasks.  Development  of  an  extensive 
library  of  custom  programs  is  not  a  viable  option  for  the  Naval  Audit  Service  at  this 
time.  The  amount  of  work  required  to  develop,  test,  and  maintain  these  programs  is 
significant.  There  are  only  a  few  computer  specialists  in  the  Naval  Audit  Service  and 
their  time  and  expertise  is  required  for  performing  EDP  audits. 


In  order  for  microcomputers  to  become  fully  integrated  into  an  audit 
organization,  all  auditors  and  audit  managers  must  use  them.  Also,  the 
microcomputers  must  be  available  at  the  audit  location  and  the  audit  office. 
Restrictions  on  microcomputer  use  may  result  in  the  isolation  of  microcomputers  and 
their  users  from  normal  audit  operations.  The  survey  results  on  who  uses 
microcomputers  and  where  they  are  used  indicate  that  most  audit  organizations  are 
advocating  microcomputer  use  by  all  their  personnel  and  are  providing  the  auditors 
and  audit  managers  with  portable  microcomputers  for  use  at  the  audit  location  as  well 
as  microcomputers  for  use  in  the  audit  office.  Table  16  indicates  who  is  using  the 
microcomputers  in  the  organizations  surveyed.  Table  17  indicates  where  the 
microcomputers  are  used. 

Some  of  the  additional  issues  raised  by  the  survey  respondents  included  the 
speed  with  which  microcomputers  are  introduced  into  audit  organizations  and 
assimilated  into  the  audit  process,  controls  needed  over  microcomputer  use  and 
custody,  importance  of  software  and  hardware  compatibility,  and  use  of 
microcomputers  to  communicate  with  mainframe  computers.  Discussions  of  these 
issues  were  incorporated  into  Chapter  2,  except  for  microcomputer-to-mainframe 
communications.  This  issue  was  considered  outside  the  scope  of  this  thesis. 


TABLE  16 

MICROCOMPUTER  USERS  IN  THE  ORGANIZATION 


Users 


All  auditors 

Audit  Managers 

Specially  trained  auditors 

Some  auditors 

Technical  specialists 

EDP  auditors  only 

Reviewers 


Percentage  of  Respondents 


Total 

Federal 

74 

60 

35 

60 

14 

20 

12 

40 

12 

60 

7 

0 

2 

20 

TABLE  17 

WHERE  MICROCOMPUTERS  ARE  USED 

Location 

Percentage  of  Respondents 

Total  Federal 

Audit  Office/  Headquarter! 

98  100 

On-Site  (Portables) 

77  100 

The  extent  of  microcomputer  use  in  these  organizations  indicates  that 
microcomputers  have  become  an  increasingly  valuable  tool  for  performing  audits.  One 
of  the  organizations  surveyed  plans  to  start  conducting  fully  electronic  audits  in  the 
next  year.  While  the  Naval  Audit  Service  is  not  at  that  stage  of  microcomputer 
integration,  completely  electronic  audits  are  a  long-range  possibility. 

C.  SURVEY  OF  MICROCOMPUTER  USE  IN  THE  NAVAL  AUDIT  SERVICE 

1.  Background 

A  different  survey  questionnaire  was  sent  to  Naval  Audit  Service  personnel 
who  used  microcomputers.  The  purpose  of  this  survey  was  to  determine  how  the 
microcomputers  are  currently  used.  This  included-  what  applications  they  were  used 
for,  what  audit  areas  the  application  was  used  on,  and  if  the  application  could  be  used 
again.  Also,  the  survey  identified  problem  areas  encountered  in  using  the 
microcomputers  and  opinions  on  how  the  microcomputers  should  be  integrated  into 
the  Naval  Audit  Service.  These  data  identified  areas  for  thesis  research  and 
consideration.  Also,  they  provided  an  indication  of  how  microcomputer  use  is 
progressing  in  the  Naval  Audit  Service. 

2.  Methodology 

Survey  questionnaires  were  sent  to  27  audit  sites  that  used  microcomputers. 
All  microcomputer  users  were  asked  to  fill  out  the  questionnaire.  The  number  of 
auditors  using  the  microcomputer  varied  by  audit  site.  At  some  of  the  audit  sites  there 
were  several  microcomputer  users  who  filled  out  the  questionnaire.  At  other  sites  there 
was  only  one  primary  user.  Responses  were  received  from  18  auditors-in-charge  and  33 
auditors  at  the  various  sites. 
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Unless  otherwise  noted  all  percentages  given  in  the  survey  results  are  for 
respondents  who  answered  the  question,  in  several  cases  questions  were  not  answered 
because  of  the  respondents  lack  of  knowledge  in  the  area.  Also,  for  many  of  the 
questions,  multiple  answers  were  given  by  the  respondents.  A  copy  of  the  survey 
questionnaire  is  included  in  Appendix  D. 

3.  Results 

The  length  of  time  the  microcomputer  was  in  use  at  the  audit  sites  ranged 
from  between  3  to  6  months  to  over  a  year.  The  majority  of  the  users  did  not  have 
any  previous  experience  in  using  microcomputers,  although  24%  of  the  respondents 
had  their  own  microcomputers  at  home.  Table  18  details  the  experience  of  the 
microcomputer  users. 


Discussions  with  audit  site  personnel  disclosed  that  there  were  generally  one 
or  two  primary  users  of  microcomputers.  The  remainder  of  the  site  audit  staff  either 
did  not  use  the  microcomputer  or  used  it  only  for  word  processing  tasks.  Some  of  the 
problems  encountered  in  using  the  microcomputer  indicate  why  microcomputer  use  is 
not  greater.  Table  19  lists  problems  encountered  by  Naval  Audit  Service 
microcomputer  users.  The  two  biggest  problems  were  lack  of  formal  training  and  the 
time  required  to  learn  how  to  use  the  microcomputer.  These  problems  are 
compounded  by  the  fact  that  over  half  of  the  potential  users  have  no  prior  experience 
with  microcomputers.  In  addition,  two  other  problems  limit  the  use  of 
microcomputers.  These  are  hardware  reliability  and  access  to  an  available  machine. 
These  problems  should  abate  as  more,  better  quality  microcomputers  are  purchased. 
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TABLE  18 

PREVIOUS  EXPERIENCE  IN  USING  MICROCOMPUTERS 


Previous  Experience 
None 

Home  (own  a  microcomputer) 

Previous  Job- 

College 


Percentage  of  Respondents 

59 

24 

16 

12 


TABLE  19 

PROBLEMS  IDENTIFIED  IN  USING  MICROCOMPUTERS 
Problem  Percentage  of  Respondents 


Time  required  to  learn  how  to  use  55 
Lack  of  formal  training  51 
Access  to  a  free  machine  37 
Hardware  reliability  37 
Developing  the  right  application  24 
Other  24 
Poor  software  documentation  6 


The  applications  for  which  microcomputers  were  used  in  the  Naval  Audit 
Service  were  similar  to  the  microcomputer  applications  in  private  industry  and  other 
Federal  audit  organizations.  However,  the  extent  of  usage  is  not  as  high  in  the  Naval 
Audit  Service  as  it  is  in  private  industry  and  other  Federal  audit  organizations.  Two  of 
the  possible  reasons  for  this  may  be  the  inexperience  of  the  Naval  Audit  Service  users 
and  the  length  of  time  microcomputers  have  been  used  at  most  of  the  audit  sites. 
Table  20  shows  the  microcomputer  applications  used  in  the  Naval  Audit  Service.  The 
table  breaks  down  this  usage  figure  by  length  of  time  the  microcomputers  were 
available  at  the  audit  site.  The  results  contained  in  Table  20  are  inconclusive 
concerning  increased  use  of  microcomputer  applications  the  longer  the  microcomputer 
is  available.  However,  it  does  appear  that  complex  applications  are  used  more  and  a 
greater  variety  of  applications  are  developed  and  performed. 

One  series  of  questions  in  the  survey  asked  what  specific  functional  areas, 
audit  programs,  and  audit  steps  the  microcomputers  were  used  on.  The  results  would 
help  determine  the  feasibility  of  developing  a  data  base  of  audit  applications  for  a 
specific  program  and/or  audit  step.  The  results  received  were  inconclusive  for  several 
reasons.  Many  of  the  respondents  did  not  answ'er  this  question.  Those  who  did 
answer  the  question  either  used  the  microcomputer  for  special  audits  or  did  not  identify 
the  applications  in  enough  detail.  A  follow-on  question  asked  whether  these 
applications  could  be  used  again.  The  majority  of  applications  could  be  reused.  Table 
21  shows  the  extent  to  which  these  applications  can  be  reused. 
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TABLE  20 

MICROCOMPUTER  APPLICATIONS  USED 


Applications 


Report  Writing 
Statistical  Sampling 
Data  Analysis 
Electronic  Workpapers 
Telecommunication 
Audit  Management 
Graphics 

Audit  Presentation 
Other 


Percentage  of  Respondents 


Total 

Micro  over 

82 

72 

75 

67 

65 

61 

39 

44 

25 

50 

22 

22 

22 

33 

14 

22 

4 

6 

The  results  contained  in  Table  21  indicate  that  users  are  developing 
applications  that  are  reusable  on  other  audits.  The  Naval  Audit  Service  should 
establish  a  central  database  for  accumulating  these  applications.  If  the  applications 
were  published  throughout  the  organization,  possibly  they  could  be  used  on  other 
audits.  Also,  auditors  may  be  able  to  modify  the  applications  to  perform  other  audit 
steps.  Finally,  the  existing  applications  may  assist  the  microcomputer  users  in 
developing  new  applications. 

Publicizing  audit  applications  is  one  way  to  facilitate  the  integration  of 
microcomputers  into  the  audit  process.  There  are  several  other  methods  that  could  be 
used  to  achieve  integration.  One  of  the  survey  questions  asked  the  user's  opinion  on 
how  the  Naval  Audit  Service  should  achieve  integration  of  the  microcomputers.  None 
of  the  alternatives  given  in  the  question  was  preferred  by  a  majority  of  the  users.  The 
comments  included  on  some  of  the  responses  indicate  a  wide  range  of  opinion  on  this 
question.  Some  users  emphatically  stated  that  Headquarters  should  not  develop  the 
applications.  Others  thought  this  was  the  best  integration  solution.  Some  respondents 
felt  that  audits  and  audited  activities  were  too  varied  for  standard  audit  applications  to 
be  useful.  However,  they  did  feel  that  standard  applications  for  administrative  tasks 
was  a  good  idea.  Some  respondents  felt  that  microcomputers  should  not  be 


TABLE  21 

ABILITY  TO  REUSE  MICROCOMPUTER  APPLICATIONS 

Ability  to  Reuse  Percentage  of  Respondents 

Yes,  the  next  tine  this  audit 
is  performed  (same  activity). 

45 

Yes,  for  audits  of  the  same 
type  of  activity. 

43 

Yes,  every  time  this  audit 
program  step  is  performed. 

22 

Unable  to  determine  at  this 
time. 

14 

No 

2 

used  on  all  audits  and  that  development  of  standard  applications  would  force  them  to 
apply  microcomputer  technology  where  it  was  not  appropriate.  The  best  solution' 
appears  to  be  a  combination  of  two  alternatives.  Develop  standard  applications  for 
administrative  tasks  but  allow  the  individual  auditor  to  develop  audit  applications. 
Audit  applications  previously  used  on  audits  could  be  distributed  organization-wide  in 
conjunction  with  this  alternative.  Table  22  lists  the  results  for  this  question. 

The  Naval  Audit  Service  microcomputer  users  surveyed  are  realizing  benefits 
from  the  microcomputers  despite  their  inexperience  and  problems  with  using  them. 
The  benefits  identified  include  better-looking  output,  ability  to  analyze  more  data,  less 
time  spent  on  repetitive  tasks,  and  enhanced  reliability  in  statistical  sampling.  Table  23 
lists  the  benefits  identified  from  using  microcomputers.  In  addition,  most  of  the 
respondents  believe  that  the  potential  level  of  microcomputer  use  will  eventually  be 
high  for  both  audit  and  administrative  tasks.  Table  24  lists  the  respondents  opinions 
on  potential  level  of  microcomputer  use. 
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TABLE  22 

ALTERNATIVES  FOR  INTEGRATING  MICROCOMPUTERS 


Alternatives  Percentage  of  Respondents 

Users  should  develop  their  own  37 

applications  and  distribute  then 
to  other  auditors  via  a  NAS  computer 
newsletter  or  an  electronic  bulletin 
board. 

Standard  routine  should  be  developed  33 

for  repetitive  atbninistrative  tasks 

but  audit  applications  should  be 

developed  each  time  an  audit  is 

performed. 

Headquarters  should  develop  standard  31 

software  applications  for  audit 

?rogram  steps  and  administrative 
asks. 

Other  24 


TABLE  23 

BENEFITS  FROM  USING  MICROCOMPUTERS 

Benefits  Percentage  of  Respondents 

Less  time  spent  on  repetitive  tasks  65 

Better  looking  output  57 

Enhanced  reliability  in  statistical  sampling  53 

Ability  to  review  larger  amounts  of  data  51 

Enhanced  reliability  of  data  analysis  33 

Other  24 


TABLE  24 

POTENTIAL  LEVEL  OF  MICROCOMPUTER  USE 


Audit  Tasks 


Percentage  of  Respondents 


High 

Medium 

Low 


63 

35 

2 


Administrative  Tasks 


High 

Medium 

Low 


88 

12 

0 


The  majority  of  microcomputer  users  in  the  Naval  Audit  Service  are  just 
beginning  to  realize  the  microcomputer's  potential  for  performing  audit  and 
administrative  tasks.  This  was  shown  by  the  responses  received  to  survey  questions 
concerning  applications  the  users  wanted  to  do  but  could  not  and  what  other  types  of 
software  the  Naval  Audit  Service  should  purchase.  On  the  majority  of  questionnaires 
these  questions  were  left  blank.  Also,  some  respondents  indicated  they  were  too 
inexperienced  in  using  microcomputers  to  know  of  any.  Some  of  the  respondents 
stated  that  they  were  not  fully  utilizing  the  software  they  already  had  available.  This 
situation  should  change  as  the  microcomputer  users  gain  experience  and  receive 
additional  training. 

D.  PUBLISHED  SURVEY  ON  MICROCOMPUTER  USE 

A  survey  of  microcomputer  use,  management  and  control  was  conducted  by  Price 
Waterhouse  &  Company  for  the  National  Association  of  Accountants  in  1984. 
Participants  in  the  survey  covered  a  wide  range  of  businesses  that  were  geographically 
dispersed  throughout  the  country  and  included  both  large  and  small  companies.  While 
the  survey  covered  a  number  of  topics  that  are  not  discussed  in  this  thesis  some  of  the 
survey  results  are  useful  for  illustrating  how  microcomputers  are  used  and  raising  issues 
concerning  microcomputer  use  for  accountants  and  auditors.  These  questions  and 
survey  results  are  included  in  Table  25.  Consult  the  published  document  for  a  detailed 
discussion  of  the  survey  and  its  results. 
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Although  only  20%  of  the  survey  respondents  worked  in  the  auditing  area,  the 
results  of  this  survey  are  still  pertinent  to  audit  organizations  that  are  using  or 
contemplating  using  microcomputers.  The  respondents  used  microcomputers  for  a 
large  number  of  applications.  Since  this  survey  was  conducted,  both  the  number  of 
microcomputer  applications  and  their  level  of  use  has  probably  increased.  Particular 
applications  that  are  useful  for  auditors  include  on-line  access  to  records,  mailing  lists, 
electronic  mail,  and  word  processing.  How  these  applications  can  be  used  in  the  audit 
process  was  discussed  earlier  in  this  thesis. 

The  questions  on  microcomputer  policy,  controls  and  training  support  the 
discussion  contained  in  Chapter  2  of  this  thesis.  The  companies  used  a  variety  of 
methods  to  provide  microcomputer  users  with  necessary  training.  Microcomputer 
training  was  not  discussed  in  detail  in  this  thesis.  However,  survey  results  from  the 
Naval  Audit  Service  microcomputer  users  disclosed  that  training  is  an  important 
consideration.  The  NAA  survey  results  provide  a  list  of  training  methods  used  by 
other  companies.  This  information  provides  training  alternatives  to  the  Naval  Audit 
Service. 

The  existence  of  a  technical  support  group  in  the  majority  of  companies  is 
another  important  point.  As  previously  discussed,  this  is  one  method  for  achieving 
integration  of  microcomputers  into  an  audit  organization.  The  methods  and  personnel 
used  to  implement  the  technical  support  group  provides  audit  organizations  with 
alternatives.  [Ref.  10] 

The  questions  concerning  software  development  highlight  some  important 
considerations  for  audit  organizations.  Software  development  must  be  performed 
correctly  to  ensure  that  software  products  will  meet  desired  goals  and  perform  as 
expected.  Software  must  be  adequately  tested  and  documented.  Otherwise  there  is 
little  assurance  that  the  software  program  will  produce  the  desired  results.  Also,  if  the 
software  is  not  adequately  documented  it  will  be  difficult  to  use  and  maintain.  This 
will  be  especially  true  if  the  original  developer  leaves  the  organization. 

The  importance  of  internal  controls  over  microcomputer  hardware  and  software 
is  recognized  by  all  organizations.  There  are  many  ways  to  achieve  adequate  control 
over  microcomputer  hardware  and  software.  Answers  to  the  survey  question  illustrate 
a  few  of  them.  The  important  point  is  that  these  controls  are  developed,  publicized 
throughout  the  organization  and  enforced.  Microcomputer  hardware  and  software  can 
be  a  large  investment  for  an  organization.  Also,  auditors  are  using  microcomputers  to 
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perform  more  audit  tasks.  The  negative  impact,  on  auditor  productivity  and  audit 
effectiveness,  of  loss  or  destruction  of  these  assets  will  increase  as  microcomputers  are 
used  more  in  the  audit  process. 


TABLE  25 

NAA  SURVEY  RESULTS 

Questions  Percentage  of  Respondents 

In  what  applications  are 
microcomputers  being  used 
in  your  company? 

Standalone  accounting 

52 

Online  access  (read  only)  to 
accounting  and  other  corporate 
records 

28 

Online  data  entry  to  accounting 
and  other  corporate  records 

18 

Engineering/Research  & 

Development  accounting  and 
other  corporate  records 

24 

Hailing  Lists 

36 

Electronic  Mail 

25 

Budgeting/Forecasting 

81 

Word  Processing 

69 

Cash  management 

27 

Telex 

10 

Timesharing 

28 

Has  your  company  established 
management  policies  covering 
the  use  of  microcomputers? 

Yes 

57 

No 

43 

TABLE  25 

NAA  SURVEY  RESULTS  (CONT'D.) 


Has  your  company  established 
a  policy (ies)  covering  the 
acquisition  of  microcomputers 
and  microcomputer  software? 

Yes  83 

No  17 

Does  your  company  provide  training 
to  microcomputer  users? 

Yes  78 

No  22 

If  yes,  what  types  of  training 
are  used. 

Internal  classes  63 

External  classes  35 

Instructional  materials  and 
tutorials  purchased  from 

third  parties  62 

Instruction  by  experienced 

users  within  the  company  75 

Other  8 


Does  your  company  have  a 
microcomputer  technical 
group  which  assists  users 
with  problems? 


Yes 


59 


TABLE  25 

NAA  SURVEY  RESULTS  (COXT'D.) 


Zf  yes,  what  is  the  background 
of  the  member (s)  of  this 


group? 

Accounting  14 

EOP  96 

Other  18 

If  no,  does  your  company  have 
an  arrangement  with  an  outside 
vendor,  consultant,  etc.  to 
provide  assistance  to  users? 

Yes  35 

No  65 

Do  users  develop  their  own 
software? 

Yes  49 

’No  51 

If  yes,  is  there  a  requirement 
that  software  be  tested  by  an 
authorized  individual? 

Yes  32 

No  68 


And  if  yes,  is  there  a  requirement 
that  such  software  be  documented 
in  accordance  with  established 
standards? 


Yes 

No 


32 

68 


TABLE  25 

NAA  SURVEY  RESULTS  (CONT'D.) 


How  is  access  to  microcomputers, 
software,  and  applications 
controlled? 


Only  authorized  personnel  are 
allowed  to  use  particular 
machines 

55 

Locked  rooms 

29 

Machine  on/off  switch  is 
locked 

6 

Program  and  data  diskettes 
are  physically  secured 

58 

Password  protection  at  entry 
level 

30 

Manual  and  automated  computer 
logs  are  required  and  monitored 

a 

Which  of  the  following  are  used 
to  ensure  backup  of  your 
microcomputers  and  microcomputer 
software? 

Backup  copies  of  all  program 
disks  are  maintained  in  a 
central  location  away  from 
all  microcomputers 

28 

Backup  copies  of  all  programs 
are  stored  in  a  protected  area 

29 

Backup  copies  of  all  program 
disks  are  maintained  m  the 
jacket  provided  with  the 
program  manual 

29 

Users  are  instructed  to 
maintain  backup  copies  of 
data  files  at  regular  intervals 

75 

TABLE  25 

NAA  SURVEY  RESULTS  (CONT'D.) 


Do  the  microcomputers  _ in  your 


company  communicate  with  other 
computers? 

Yes  61 

No  39 

With  which  of  the  following  do  your 
microcomputers  communicate? 

Other  microcomputers  within 

the  company  49 

Minicomputers  or  mainframes  within 

the  company  76 

Word  processing  equipment  within 

the  company  35 

Computers  external  to  the  company 

(through  external  time  sharing  • 

network)  57 

In  what  area  do  you  work? 

Finance/ accounting  43 

Data  processing  33 

Internal  audit  (EDP  background)  8 

Internal  audit  (accounting 

background)  11 

Other  5 


V.  CONCLUSIONS 


A.  INTRODUCTION 

The  purpose  of  this  thesis  was  to  identify  specific  ways  to  use  microcomputers  in 
the  Naval  Audit  Service.  In  particular,  this  thesis  was  concerned  with  how  the 
microcomputer  could  increase  the  efficiency  and  the  effectiveness  of  the  auditors  and 
audit  managers  in  the  Naval  Audit  Service. 

First,  this  thesis  discussed  processes  and  policies  for  introducing  microcomputers 

into  the  Naval  Audit  Service  successfully.  The  Naval  Audit  Service  workload  was 

analyzed  for  areas  in  which  microcomputers  could  be  quickly  assimilated  into  the  audit 

process.  A  quick  assimilation  would  provide  a  fast  payback  and  ensure  a  niche  for 

microcomputers  Within  the  Naval  Audit  Service.  Next,  off-the-shelf  software  was 

identified,  reviewed  and  tested  for  possible  use  in  audit  applications.  Finally,  a  survey 

was  conducted  to  compare  current  microcomputer  practices  within  audit  organizations. 

The  survey  ivas  conducted  in  audit  departments  in  civilian  industry,  CPA  firms,  other 

J 

federal  government  agencies  and  the  Naval  Audit  Service. 

B.  SUMMARY  AND  RECOMMENDATIONS 

1.  The  Process  of  Introducing  and  Integrating  Microcomputers  into  the  Audit 

Microcomputers  are  a  new  tool  for  the  Naval  Audit  Service.  As  a  new  tool, 
the  microcomputer  represents  change  for  the  Audit  Service.  The  planned  program 
approach  to  introducing  and  integrating  microcomputers  into  the  audit  organization  is 
considered  the  most  effective  method  to  manage  change.  This  presumes  that  the 
program  is  presented  in  a  prioritized  manner.  Managing  the  change  process  effectively 
[  will  significantly  reduce  the  uncertainty  associated  with  the  change.  Managers  should 

consider  the  technical  and  political  impact  of  the  change  when  choosing  courses  of 
action  to  follow.  The  first  aspect  of  the  technical  impact  includes  microcomputer 
support  in  the  form  of  a  technical  resource  person  (who  also  understands  auditing) 
available  full-time  to  guide  microcomputer  users  in  applications  of  the  microcomputer 
and  to  solve  problems  encountered  in  using  the  microcomputer.  The  second  aspect  of 
the  technical  impact  is  training.  Managers  should  include  microcomputer  training  as 
part  of  indoctrination  for  new  personnel  and  also  as  part  of  continuing  education  for 
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auditors.  The  political  impact  of  introducing  microcomputers  may  necessitate 
organizational  design  changes  to  accomodate  the  new  tool.  Rules  and  procedures 
should  be  developed  to  ensure  efficient  and  effective  use  of  microcomputers  and  to 
allow  for  individual  creativity  and  initiative  in  applying  the  new  tool  to  daily  work.  An 
enforceable  implementation  plan  should  be  developed  and  followed  after  the  program 
strategy  is  chosen.  As  the  implementation  plan  is  followed,  forces  resisting  the  change 
to  microcomputers  can  be  overcome  by  support  from  top  management,  demonstrating 
a  clear  perception  of  the  need  for  microcomputers,  presenting  a  well-defined  problem 
suitable  for  solution  by  microcomputer  and  seeking  an  early  commitment  from 
everyone  in  the  organization. 

a.  Management  Policies  for  Successful  Implementation 

The  Department  of  Defense  has  issued  mandatory  guidance  that  should  be 
considered  as  a  minimum  for  successful  implementation  of  microcomputers  in  the 
Naval  Audit  Service.  Briefly,  the  Defense  guidance  calls  for  each  agency  to  develop  a 
plan  for  integrating  computerized  techniques  into  the  audit  process,  a  plan  for  effective 
and  efficient  use  of  current  computer  resources,  effective  controls  and  oversight  to 
ensure  reliability  of  computer  equipment  and  work,  protection  of  sensitive  data, 
effective  training  in  the  use  of  microcomputers  and  documentation  of  the  use  of 
microcomputers  during  audits. 

The  microcomputer  is  useless  by  itself.  It  must  have  software  and 
knowledgeable  users  to  unlock  its  potential.  Reliable  software  can  be  obtained  by 
staying  with  proven  products,  insisting  on  user-friendly  programs,  reviewing  references 
by  present  or  past  users  of  the  software  and  thorough  testing  of  the  software  before 
purchase.  The  objectives  of  microcomputer  use  should  be  to  make  the  microcomputer 
an  individual  tool  and  to  automate  only  if  efficiency  or  effectiveness  will  be  improved. 

b.  The  Benefits  and  Constraints  of  Microcomputers 

Microcomputers  have  the  potential  to  increase  office  efficiency,  improve 
operating  methods,  reduce  physical  effort,  reduce  the  risk  of  overlooking  material  items 
and  increase  the  audit  organization's  capacity  to  handle  work  volume.  However,  the 
auditor  must  also  be  cautious  of  the  physical,  operating  and  user  constraints  associated 
with  this  new  tool.  The  auditor  must  adequately  prepare  for  continuing  the  audit  in  the 
event  that  the  microcomputer  or  any  one  of  its  functions  is  suddenly  not  available. 
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c.  Microcomputers  and  the  Naval  Audit  Service  Workload 

The  workload  analysis  showed  that  the  Naval  Audit  Service  has  a  workload 
that  is  too  diverse  to  develop  standard  microcomputer  applications  that  would  be 
applicable  to  a  large  portion  of  the  workload.  However,  the  workload  analysis  also 
disclosed  that  likely  candidates  for  standardization  of  procedures  exist  at  the 
continuous  audit  sites  and  in  audits  where  similar  functional  areas  are  examined  across 
different  commands  throughout  the  Navy  and  Marine  Corps.  In  addition,  the  goal  of 
standardization  should  be  transportability  of  programs  and  procedures  and  the 
elimination  of  duplicate  effort  across  the  Naval  Audit  Service. 

2.  Software  Applications  and  Audit  Service  Processes 

There  are  hundreds  of  computer  programs  available.  Sources  include 
commercial  vendors,  public  domain  libraries  and  government  agencies.  In  addition, 
there  are  differences  in  capabilities  and  intended  uses  within  each  category  of  software, 
such  as  between  personal,  professional  and  corporate  word  processors.  Before 
purchase,  software  should  be  evaluated  in  terms  of  desired  features,  capabilities,  cost 
and  expected  benefits. 

3.  Survey  of  Current  Microcomputer  Use  by  Audit  Organizations 

The  audit  organizations  surveyed  have  started  to  realize  the  microcomputer  s 
potential  in  performing  audit  tasks.  This  was  shown  by  both  the  extent  of 
microcomputer  use  and  the  number  of  different  audit  applications  performed.  The 
underlying  trend  in  the  survey  data  was  one  of  microcomputer  use  by  all  auditors  in 
the  organization.  The  volume  of  applications  varied  but  the  majority  of  the 
respondents'  microcomputer  use  was  equal  to,  if  not  greater  than,  that  in  the  Naval 
Audit  Service.  Generally,  these  applications  were  implemented  by  using  commercial 
software  products.  However,  almost  half  of  the  organizations  developed  their  own 
custom  software  programs  for  specialized  or  unique  applications.  Almost  all  the 
survey  respondents  used  both  portable  and  desk-top  microcomputers  to  implement 
these  applications. 

The  National  Association  of  Accountants'  survey  results  detailed 
microcomputer  applications  that  were  performed  in  companies  by  both  auditors  and 
other  employees.  These  applications  can  be  used  in  the  audit  process  and  the  daily 
operations  of  an  audit  organization.  Also,  this  survey  highlights  microcomputer  issues 
that  audit  organizations  should  consider.  Adequate  policies  and  controls  over  software 
and  hardware  assets  are  needed.  The  survey  details  some  controls  that  are  used.  Also, 
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the  survey  results  provide  alternative  training  methods  and  ways  of  providing  necessary 
training.  Audit  organizations  should  give  microcomputer  training  a  high  priority, 
especially  when  the  microcomputer  users  in  the  organizations  are  inexperienced. 

The  results  from  these  two  surveys  support  current  microcomputer  policy  and 
usage  in  th*  Naval  Audit  Service.  The  Naval  Audit  Service  has  implemented  control 
policies  and  procedures  for  its  microcomputer  hardware  and  software  assets.  The  level 
of  microcomputer  usage  in  the  Naval  Audit  Service  is  not  as  high  as  in  the  private 
industry  and  other  federal  government  audit  organizations  surveyed.  However,  the 
microcomputer  software  used  and  the  applications  developed  in  the  Naval  Audit 
Service  are  similar  to  those  of  the  survey  respondents.  Also,  the  Naval  Audit  Service 
practice  of  not  restricting  who  can  use  the  microcomputer  is  supported  by  the  survey 
results  in  other  audit  organizations. 

The  private  industry  and  federal  government  survey  results  point  out  one  area 
of  microcomputer  usage  and  support  that  the  Naval  Audit  Service  should  consider. 
The  use  of  lap-top  microcomputers  for  performing  audits  is  one  area.  Currently,  the 
microcomputers  used  in  the  Naval  Audit  Service  are  either  luggable  or  desk,  top 
models.  It  is  not  practical  to  take  these  microcomputers  from  the  audit  site.  The 
Naval  Audit  Service  should  consider  purchasing  a  few  lap-top  microcomputers  for 
performing  audits  at  other  than  permanent  audit  sites.  The  need  for  truly  portable 
computers  will  increase  as  auditors  become  more  dependent  upon  them.  Also,  these 
microcomputers  could  be  used  at  the  audit  site. 

The  NAA  survey  results  on  training  and  support  of  microcomputers  is  of 
interest  to  the  Naval  Audit  Service  because  the  majority  of  its  microcomputer  users  are 
inexperienced.  The  survey  results  list  alternatives  to  consider  in  these  areas.  The 
Naval  Audit  Service  should  conduct  a  further  review  of  the  costs  and  benefits  of  each 
of  these  alternatives.  Then  a  microcomputer  training  and  support  plan  could  be 
developed  to  meet  the  users'  needs. 

The  survey  results  from  the  Naval  Audit  Service  microcomputers  detail 
positive  and  negative  results  of  using  microcomputers.  The  overall  attitude  of  users 
towards  microcomputers  is  positive.  Already,  benefits  have  been  realized  from  using 
the  microcomputers.  The  overwhelming  majority  of  users  believe  that  the  potential 
level  of  microcomputer  use  will  be  high  for  both  audit  and  administrative  tasks. 
However,  the  users  are  experiencing  problems  because  of  their  inexperience  in  using 
microcomputers  and  a  lack  of  formal  training  in  microcomputer  hardware  and 


software.  Also,  the  users  need  a  method  for  sharing  applications  developed  for  audit 
and  administrative  tasks.  This  will  increase  the  use  of  microcomputers  and  expose 
more  users  to  different  applications.  Naval  Audit  Service  management  can  use  these 
survey  results  to  help  plan  the  implementation  and  integration  of  microcomputers  into 
the  organization. 


APPENDIX  A 
GLOSSARY 


AIS  -  Automated  Information  System. 

ASCII  •  American  Standard  Code  of  Information  Interchange.  Under  this  scheme, 
each  character  used  by  a  computer  is  assigned  a  unique  binary  bit  sequence  that 
translates  into  decimal  numbers  from  0  to  155.  Each  unique  bit  sequence  causes  a 
unique  character  to  be  displayed  or,  in  the  case  of  non-displaving  characters, 
recognized  by  and  acted  on  by  the  computer. 

BASIC  -  Beginners  All-purpose  Svmbolic  Instruction  Code.  A  high-level  computer 
language  widely  used  to  write  programs  for  microcomputers.  The  BASIC  interpreter 
translates  each  program  instruction  into  machine-readable  code  on  a  line-bv-line  basis 
as  the  microcomputer  executes  the  program 

BAUD  -  A  unit  of  measure.  The  number  of  times  that  a  transmission  line  changes  state 
in  one  second.  The  speed  of  the  transmission  line  is  directly  proportional  to  the  baud 
rate. 


CALDAY  LOE  -  Calendar  day,  level  of  effort. 


CPM  -  Control  Program  for  Microcomputers.  A  program  written  to  control  the 
operation  of  microcomputers.  Operating  svstem  programs,  in  general,  free  users  from 
tne  need  to  understand  complicated  machine  languages  in  order  to  accomplish 
coordination  and  control  of  the  components  that  make  up  a  microcomputer,  sucn  as 
the  main  memorv,  disk  drives,  tape  drives,  printer,  display  monitor  and  others.  It  is 
used  on  computers  built  by  Apple,  Commodore,  and  others. 

DECISION  SUPPORT  SYSTEMS  -  (abbr.  DSS)  A  DSS.is  a  tool  that  aids,  but  does 
not  replace,  human  judgement  during  the  decision-making  process.  Some  DSS  operate 
using  specific  algorithms  from  the  quantitative  disciplines  and  others  are  based 
completely  on  heuristics.  DSS  are  not  required  to  be  implemented  through  a 
computer,  although  they  frequently  are  so  implemented. 

LINKED  SPREADSHEET  -  A  group  of  spreadsheets,  stored  as  separate  files,  that  are 
concurrently  updated,  automatically,  whenever  one  or  more  of  the  linked  spreadsheets 
in  the  group  is  updated. 


MACRO  -  A  list  of  keystrokes,  normally  executed  by  the  user  but  imbedded  within  a 
file,  which  is  executed  by  the  computer  so  that  the  program  runs  as  if  the  user  had 
directed  the  program  run  sequence  from  the  keyboard. 

MODEM  -  Modulator,  DEModulator.  A  device  that  converts  the  digital  signals 

f»roduced  by  the  transmitting  computer  into  analog  signals  for  transmission  over  a 
elephone  fine,  and  re-converts  tne  analog  telephone  signal  into  digital  signals 
understood  by  the  receiving  computer. 


MS-DOS  -  Microsoft  Dj^sk  Operating  Svstem.  A  program  written  bv  Microsoft,  Inc.  to 
control  the  operation  of  the  IBM  personal  computer.  Operating  svstem  programs,  in 
general,  free  users  from  the  need  to  understand  complicated  machine  languages  in 
order  to  accomplish  coordination  and  control  of  the  components  that  make  up  a 
microcomputer,  such  as  the  main  memorv,  disk  drives,  tape  drives,  printer,  displav 
monitor  and  others.  It  is  also  used  on  IBM-compatible  computers  built  bv  Compaq, 
TeleVideo,  Zenith,  Sanyo,  and  others. 


RAM  -  Random  Access  Memorv'.  Volatile  memorv  within  a  computer's  main  memorv 
area  (i.e.,  the  computer's  brain’J.  All  information  in  RAM  is  lost  when  the  computer 
is  turned  off. 


SCREEN  PAINTER  -  A  computer  program  that  develops  data  entry  displavs  and 
menus. 


TEMPEST  CERTIFIED  -  Government  certification  tl\at  an  electronic  data 
manipulating  device  is  authorized  to  handle  classified  information. 

XMODEM  *  A  method  of  transmitting  digital  data  via  a  modem  in  which  the  data  to 
be  transmitted  is  divided  mto  groups  of  data  bits,  called  packets,  before  being 
transmitted.  In  addition  to  the  user-related  data,  each  packet  contains  control  data, 
called  overhead,  that  allows  the  modem  and  the  microcomputer  to  recognize  the 
beginning,  ending,  and  loss  of  packets  during  transmission. 
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Min  price  » 


Figure  3.1  Sample  Work  Paper  Template  For  Use  During  Contract  Audits. 


DISK:  X1098X  Double-Sided  9-seet  337K  frM  10-13-1986  00:05:11 

FILE  NAME  -SIZE  DATE  CATEGORY  DESCRIPTION 

GENERAL  .SEC  202  10/13/86  C rose -ref.  Audit  workpapers  to  supporting  docs 

A_100  . HKS  1408  10/13/86  Spraadsht.  123  t sop la to  for  inventory  audit 

A.101  .HKS  1408  10/13/86  Sproadsht.  123  taoplata  for  fumitura  audit 

A_102  .HKS  1408  10/13/86  Spraadsht.  123  template  for  Plant  *  Equipment 

A.103  .HKS  1408  10/13/86  Spraadsht.  123  taoplata  for  vehicles  audit 

A_104  .HKS  1408  10/13/86  Spraadsht.  123  taoplata  for  welfare  A  rec  audi 

SAMPLING. DES  218  10/13/86  Statistics  Daser  of  statistical  samples  taken 

ASSIGWT.LTR  63  10/13/86  Horkpapar  Assignment  latter 

AUDIT  .PGM  91  10/13/86  Horkpapar  Audit  program 

CHANGES  .LST  110  10/13/86  Horkpapar  List  of  AIC/AD  major  changes 

C0NFERNC.CLS  99  10/13/86  Horkpapar  Cloaing  oonfaranoa  reoord 

C0NFERNC.0PN  147  10/13/86  Horkpapar  Opening  oonfaranoa  record 

CONTENTS. TBL  108  10/13/86  Horkpapar  Horkpapera*  tabla  of  content. 

FINAL  .DBF  52  10/13/86  Horkpapar  Final  debrief 

FINAL  .RPT  45  10/13/86  Horkpapar  Final  audit  report 

FINDINGS. OFT  109  10/13/86  Horkpapar  Draft  findings 

MISCREMA.RKS  112  10/13/86  Horkpapar  Miscallanaoua  information 

GC -CHECK. LST  95  '10/13/86  Horkpapar  Completed  quality  oontrol  checklist 

REPORT  .010  67  10/13/86  Horkpapar  Completed  audit  report  proe  guide 

SURVEY  .DBF  53  10/13/86  Horkpapar  Initial  survey  dabrief 


Figure  3.2  DISKCAT  Output  Listings. 


EXAMPLE  OF  A  FINANCIAL  PROFILE 
OF  THE 

NAVAL  OIVINB  AND  SALVAGE  TRAINING  CENTER 
AS  OF  30  SEPTEMER  1963 


OAMN  Funding  Authorization  (FY  1983) 

Mission  Operations 
Training  Papa rta ant 
Diving  and  Salvage 
Administration 
Travel 

Base  Operations 

Audio  Visual 
Purchasing 

Supply  Support  Hyperbar ica 
Supply  Support  Ships 
Maintenance  of  Crafts 
Utilities 

General  Engineering  Sipport 

Telephones 

Vehicles 

Medical  Department 
Civilian  Labor 


Total 


0 


Status  of  Fund  Authorization 

Obligations 

Commitments 

Expenditures 

Total 


Total  Available  Balance 


0 


0 


Figure  3.3  Example  Financial  Profiles  Using  1-2-3. 
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EXAMPLE  OF  AN  OPERATIONS  SUMMARY 
OF  THE 

NAVAL  0 IVINS  AND  SALVASE  TRAINING  CENTER 
AS  OF  SO  SEPTEWER  1983 

Piriortwl 


Military 

Currant  Allocation 

On  Board 
Vacancies 

Departments  Authorized 

Supply/Purchasing 

Comptroller 

Maintenance 

Medical 

Training 

Executive 


Totals  0 


$<4)ply 

Average  Number  of  Requisitions 
Processed  Monthly 

Number  of  Line  Items  Stocked 

Value  of  Inventory 


Purchasing 


No. 

Service  Contracts  Awarded 

BPA  Cells  Placed 

Purchase  Orders  Issued 

Totals 

0 

Purchase  Action  Categories 

No. 

Competitive 

Non-Competitive 

Totals 

0 

taaaa 

Civilian 


On -board 


0 


Value 


to 


Value 


to 


Figure  3.4  Example  Operations  Summary  Using  1-2-3. 


Plant  Proparty 


Class  1  —  Land 
Class  2  —  Building 
Class  3  —  Equipment 
Class  4  —  Industrial 

Total 


Maintenance 
Jobs  Estimated 

Type  '  Scheduled  Value 

Service  Craft 
Diving  Equipment 
Salvage  Equipment 
Training  Equipment 


0  $0 

»33SmtI3»tM>a«S9I 

Training 
Number  of 

Course  Instructors 

First  Class  Diver 
Master  Diver 
Ship  Salvage 
Submarine  Rescue 


Totals  0 


$0 

lataiiau 


Jobs 

Completed 


0 

ssimnt 


Number 

Enrolled 


0 

aaitanii 


Figure  3.4  Example  Operations  Summary  Using 


Value 


•0 

33X135=31 


of  Students 
Graduated 


0 

533333331 


1-2-3.  (corn'd.) 


'.'•T 


XFPSLOO:  Begin  run  Fro*  OSS  IFPSOSS:. 

INTERACTIVE  FINANCIAL  PLANNING  SYSTEM  -  10.0  V5 

READY  FOR  EXECUTIVE  COttlANO 

MODEL 

ENTER  MODEL  NAME 
ANALYZE 1 

BEGIN  ENTERING  NEN  MOO EL 

COLIMS  1984,1987,1988,1989,1990 
AfMJAL  SALES  VOLUME  INCREASE  >1.15 
INFLATION  >1.08 
MANUFACTURING  COST  YR1  >  .19 

MANUFACTURING  COST  >  MANUFACTURING  COST  YR1, PREVIOUS  MANUFACTURING 

COSTftINFLATION 

DISTRIBUTOR  PRICE  YR1  >  .32 

ANNUAL  DISTRIBUTOR  PRICE  INCREASE  >1.05 

DISTRIBUTOR  PRICE  >  DISTRIBUTOR  PRICE  YR1, PREVIOUS  DISTRIBUTOR  PRICE  •  AM4UAL 

DISTRIBUTOR  PRICE  INCREASE 

QUANTITY  SOLD  >  1300000,  PREVIOUS  QUANTITY  SOLD  *  ANNUAL  SALES  VOLUME  INCREASE 


OPERATING  REVENUE 


SALES  >  QUANTITY  SOLD  »  DISTRIBUTOR  PRICE 

COST  OF  SALES  >  QUANTITY  SOLD  *  MANUFACTURING  COST 

NET  OPERATING  PROFIT  »  SALES  -  COST  OF  SALES 


NET  OPERATING  MARGIN  >  NET  OPERATING  PROFIT/SALES 

ft 

» 

ft  EXPENSES 


OVERHEAD  >  42000,  PREVIOUS  OVERHEAD  «  INFLATION 

ft 

ft 

BEFORE  TAX  PROFIT  «  NET  OPERATING  PROFIT  -  OVERHEAD 

ft 

ENO  OF  MOOEL 


Figure  3.6  Sample  Session  Using  a  Financial  Modeling  Program. 


SOLVE 

MODEL  ANALYZE 1  VERSION  OF 

09/17/86  18:49 

—  5  COLUMNS  14  VARIABLES 

ENTER  SOLVE  OPTIONS 

ALL 

1986 

1987 

1988 

1989 

1990 

ANNUAL  SALES  VOLUME  I NCR 

1.150 

1.150 

1.150 

1.150 

1.150 

INFLATION 

1.080 

1.080 

1.080 

1.080 

1.080 

MANUFACTURING  COST  YR1 
MANUFACTURING  COST 

.1900 

.1900 

.2052 

.2216 

.2393 

.2585 

DISTRIBUTOR  PRICE  YR1 
ANNUAL  DISTRIBUTOR  PRICE 

.3200 

1.050 

1.050 

1.050 

1.050 

1.050 

DISTRIBUTOR  PRICE 

.3200 

.3360 

.3528 

.3704 

.3890 

QUANTITY  SOLD 

1300000 

1495000 

1719250 

1977138 

2273708 

OPERATING  REVENUE 

SALES 

416000 

502320 

606551 

732411 

884386 

COST  OF  SALES 

247000 

306774 

381013 

473219 

587737 

NET  OPERATING  PROFIT 

169000 

195546 

225538 

259192 

296649 

NET  OPERATING  MARGIN 

.4063 

.3893 

.3718 

.3539 

.3354 

EXPENSES 

OVERHEAD 

42000 

45360 

48989 

52908 

57141 

BEFORE  TAX  PROFIT 

127000 

150186 

176549 

206284 

239508 

Figure  3.6  Sample  Session  Using  a  Financial  Modeling  Program,  (cont'd.) 


Figure  3.7  Microstat  Main  Menu. 
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11*000*000  POPULATION  BOOK  VALUE 
0.95  CONFIDENCE  LEVEL 

2  EXPECTED  OP  ACTUAL  NUMBER  OF  ERRORS 
0.05  MATERIALITY  RATE 
550.000  MAXIMUM  TOLERABLE  ERROR 

127  SATPLE  SIZE 

RANOOM  NUMBERS 
(DOLLAR  UNITS  TO  AUOIT) 

53.000 
256*242 
344*877 
393.101 
435*596 
474,304 
496,854 
560,127 
818,427 
841,915 
876,787 
976,851 
.  1,050,277 

1,108,111 
1,122,315 
1,194,019 
1,217,134 
1,354,386 
1,406,650 
1,583,243 
1,621,334 

1.734.804 
1,809,429 
1,864,282 
1,892,681 
1,907,495 
2,021,551 
2,130,782 
2,141,261 
2,247,925 
2,260,223 
2,444,718 
2,513,508 

2.575.804 
2,726,162 
2,909,829 
2,931,022 
2,974,575 
3,038,519 
3,044,902 
3,067,390 
3,096,549 
3,456,834 
3,536,603 
3,629,933 
3,669,333 
3,749,431 
3,876,745 
3,899,288 
3,975,910 


Figure  3.9  1-2-3  Template  for  Random  Dollar-Unit  Samples. 


95Z  UPPER  CONFIDENCE  BOUND  FOR  MEAN  ERROR: 
OOLLAR  AMOUNT  OF  UPPER  BOUND: 

99X  UPPER  CONFIDENCE  BOUNO  FOR  MEAN  ERROR: 
DOLLAR  AMOUNT  OF  UPPER  BOUNO: 


2.054X 
♦225 >919. 81 

S.046X 

♦335*017.69 


Figure  3.10  Upper  Confidence  Bound  for  Mean  Sample  Error. 


* 

HISTORICAL  DATA 

(Y) 

(XII 

(X2I 

CY  1 

/.  INVENTORY 

♦  VALUE 

«  LINE  ITEMS 

/.  VALIDITY 

RECORD  VALIDITY 

INVENTORY 

INVENTORY 

ESTIMATE 

89.30 

11*000.000 

50,000 

90.41 

92.00 

9,000,000 

65,000 

*  91.51 

93.60 

7,500,000 

30,000 

93.79 

88.00 

13,500,000 

55,000 

89.20 

88.15 

15,000,000 

62,000 

87.96 

94.00 

5,000,000 

38,000 

93.32 

89.00 

17,500,000 

66,000 

86.87 

96.00 

'  6,000,000 

20,000 

95.42 

83.00 

18,750,000 

70,000 

86.07 

85.75 

22,000,000 

80,000 

84.04 

Rag rasa ion  Output: 

Constant 

99.36543 

Std  Err  of  Y  Eat 

1.722792 

R  Squarad 

0.855056 

No.  of  Obaarvationa 

10 

Dagraaa  of  Fraadom 

7 

X  Coafficiant(s) 

>0.000000226  -0.00012 

Std  Err  of  Coaf. 

0.000000324  0.000099 

Figure  3.11  Data  and  Regression  Output  for  Inventory  Sample. 


Inventory  Validity  Projection 

Nervi  Supply  Depot,  Anywhere 


d 

y 


y 


s 

*  / 
y  ♦ 


•  -  1 

84 

i  r  i 

86 

i  i 

88 

i 

90 

i  :  ; 

92  ' 

□ 

1  SET  7AUDI3T 

+ 

*  ACT  VAUDCT 

Figure  3.12  Inventory  Validity  Regression. 
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SiLLnNiN  Ni  iiMLt  jownnVjLl 


BIWEEKLY  TIME  REPORT 
NAVAUDSVC  §220.1 


PERIOD  ENDIN6 


DIRECT  MANHOURS: 

H/W  LEAD 

AUOXT  NO.  COOC  AUO.  HON  TUE  MED  THU  FRI  HON  TUE  MED  THU  FRZ  TOTAL 


XNOIRECT  MANHOURS: 


///////////////////////// 


Training  /////////////////////////////////////////////////////// 

Y_001 _  ///// 

Ind .  Traval  /////////////////////////////////////////////////////// 

Y_002_  ///// 

Mg 1/ Admin  /////////////////////////////////////////////////////// 

Y_OOS_  ///// 

Taeh . Func .  /////////////////////////////////////////////////////// 

Y_004 _  ///// 

Laava  A  Hoi.  *  /////////////////////////////////////////////////////// 

Y_005 _  ///// 

Laava  A  Hoi.  /////////////////////////////////////////////////////// 

Y_005 _  ///// 

Othar  /////////////////////////////////////////////////////// 

Y_006__  ///// 

/////////////////////////////////////////////////////// 

///// 

/////////////////////////////////////////////////////// 

///// 

/////////////////////////////////////////////////////// 

///// 

/////////////////////////////////////////////////////// 

///// 

///// - 

TOTAL  DIRECT  A  INDIRECT  0000000000 


GRADE/RANK 


REGION 


SIGNATURE: 


APRROVED  BY: 


I  PERS  CATEGORY 
— (enter  "1"  in 
I  category ) 


1  AUDITOR 

2  AUO  M6T 

3  CONSULT 


4  MGT  SUPPORT 

5  AOMIN  SUPT 


BIHEEKLY  TIME  REPORT 
NAVAUOSVC  5220.1 


PERIOD  ENDING:  30  JUNE  1W4 


DIRECT  MANHOURS: 


N/M  LEAD 


AUDIT  NO. 

CODE  AUO. 

MON 

TUE 

NED 

THU 

FRI 

MON 

TUE 

MED 

THU 

FRI 

TOTAL 

X1098L 

04 

8 

8 

8 

4 

0 

0 

0 

0 

0 

0 

28 

X1098L 

05 

0 

0 

0 

4 

8 

8 

8 

2 

0 

0 

30 

X1098L 

06 

0 

0 

0 

0 

0 

0 

0 

4 

0 

0 

4 

X1098L 

07 

0 

0 

0 

0 

0 

0 

0 

2 

0 

0 

2 

X1098L 

14 

0 

0 

0 

0 

0 

0 

0 

0 

6 

0 

6 

X1098L 

17 

0 

0 

0 

0 

0 

0 

0 

0 

1 

0 

1 

X1098L 

18 

0 

0 

0 

0 

0 

0 

0 

0 

1 

4 

5 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 


INDIRECT  MANHOURS: 


///////////////////////// 


Training  /////////////////////////////////////////////////////// 

Y_001 _  ///// 

Ind .  Travel  /////////////////////////////////////////////////////// 

Y_002_  ///// 

Mg t/ Admin  /////////////////////////////////////////////////////// 

Y_003_  ///// 

Tech .  Fm .  /////////////////////////////////////////////////////// 

Y_004_  ///// 

Leave. A  Hoi.  /////////////////////////////////////////////////////// 

Y000576  ///// 

Leave  A  Hoi.  /////////////////////////////////////////////////////// 

Y_005_  ///// 

Other  /////////////////////////////////////////////////////// 

Y_006 _  ///// 

/////////////////////////////////////////////////////// 

•  ///// 

/////////////////////////////////////////////////////// 

///// 

/////////////////////////////////////////////////////// 

///// 

/////////////////////////////////////////////////////// 

///// 

///// - 

TOTAL  DIRECT  A  INDIRECT  8888888864 


76 


NAME 

JOHN  8.  AUDITOR 


SHADE /RANK 
I  GS-12 


SSN 

i  123-45-6789 


REGION 

HQ 


SIGNATURE: 
APPROVED  8Y: 


I  PERS  CATEGORY  1  1  AU0XT0R  4  MGT  SUPPORT 

—(enter  "l”  in  1  2  AUO  MGT  5  ADMIN  SUPT 

I  category)  3  CONSULT 


Figure  3.16  Sample  Individual  Time  Report  #1. 
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BXHEEKLY  TIME  REPORT 
NAVAUOSVC  5220.1 


PERXOO  ENDING:  50  JUNE  1984 


DIRECT  MANHOURS: 

M/M  LEAD 


AUDIT  NO. 

CODE  AUO. 

MON 

TUE 

NED 

THU 

FRI 

MON 

TUE 

MED 

THU 

FRI 

TOTAL 

X1098L 

15A 

3 

0 

0 

4 

0 

0 

0 

0 

0 

0 

7 

X1098L 

158 

0 

4 

0 

4 

0 

0 

0 

2 

0 

0 

10 

X1098L 

15C 

2 

0 

0 

0 

3 

0 

0 

4 

0 

0 

9 

X1098L 

15H 

0 

2 

0 

0 

5 

0 

0 

2 

0 

0 

9 

X1096L 

15M 

1 

0 

8 

0 

0 

0 

0 

0 

4 

0 

15 

X1098L 

15P 

0 

0 

0 

0 

0 

8 

B 

0 

1 

0 

17 

X1098L 

15Q 

0 

0 

0 

0 

0 

0 

0 

0 

1 

0 

1 

0 

0 

0 

0 

0 

0 

0 

0 


INDIRECT  MANHOURS:  /////////////////////////  0 

0 

Tra  ining  //////////////////////////// /  //////////////////////////  0 

Y_001 _  /////  0 

Ind.  Travel  /////// f //////////////////////////////////////// f //////  0 

Y_0O2_  /////  0 

Mg t/ Ada in  ///////////////////////////////////////////////////////  0 

Y000551  /////  2 

Tach. Fune.  ///////////////////////////////////////////////////////  0 

Y000441  /////  8 

Laava  A  Hoi.  ///////////////////////////////////////////////////////  0 

Y_005__  /////  0 

Laava  A  Hoi.  ///////////////////////////////////////////////////////  0 

Y_005_  *  //✓//  0 

Othar  ///////////////////////////////////////////////////////  0 

Y000492  /////  2 

///////////////////////////////////////////////////////  0 

/////  0 

///////////////////////////////////////////////////////  0 

/////  0 

///////////////////////////////////////////////////////  0 

/////  0 

///////////////////////////////////////////////////////  0 

/////  0 

///// - 

TOTAL  DIRECT  A  INDIRECT  8888888888  80 


NAME  GRADE/RANK  SSN  REGION 

ROSE  M.  ACCOUNTANT  I  GS-13  I  345-75-3452  I  HQ  I 


SIGNATURE:  I  PERS  CATEGORY  1  1  AUDITOR  4  MGT  SUPPORT 

- (an tar  "1"  in  1  2  AUO  MGT  5  AOMIN  SUPT 

APRROVED  BY:  I  category)  3  CONSULT 


Figure  3.17  Sample  Individual  Time  Report  #2 


BIHEEKLY  TIME  REPORT 
NAVAUOSVC  5220.1 


PERIOD  ENOINC:  50  JUNE  1986 


DIRECT  MANHOURS: 


M/M  LEAD 


AUDIT  NO. 

COOE  AUO. 

MON 

tuc 

MED 

THU 

PRX 

MON 

TUE 

MEO 

THU 

FRI 

TOTAL 

X1Q98L 

04 

4 

4 

8 

4 

0 

0 

0 

0 

0 

0 

22 

X1098L 

05 

0 

0 

0 

3 

5 

7 

7 

1 

0 

0 

23 

X1098L 

04 

0 

0 

0 

0 

0 

0 

0 

6 

0 

0 

6 

X1098L 

or 

0 

0 

0 

0 

0 

0 

0 

1 

0 

0 

1 

X1096L 

16 

0 

0 

0 

0 

0 

0 

0 

0 

6 

0 

6 

X1096L 

23 

0 

0 

0 

0 

0 

0 

0 

0 

1 

6 

7 

X1098L 

34 

0 

0 

0 

0 

0 

0 

0 

0 

1 

1 

2 

X1102A 

01A 

1 

0 

0 

0 

0 

0 

0 

0 

0 

0 

1 

X1102A 

02C 

0 

3 

0 

0 

0 

0 

0 

0 

0 

0 

3 

X1102A 

03A 

1 

1 

0 

1 

3 

0 

0 

0 

0 

0 

6 

X1102A 

03C 

0 

0 

0 

0 

0 

1 

1 

0 

0 

1 

3 

INOIRECT  MANHOURS: 


///////////////////////// 


Training  /////////////////////////////////////////////////////// 

Y_001_  ///// 

Ind .  Travel  /////////////////////////////////////////////////////// 

Y_002 _  ///// 

Mg t/ Adi  in  //////////////////////////////////  //////////////////// 

Y_005 _  /✓///  2 

Taeh . Pune .  /////////////////////////////// f /////////////////////// 

Y_004_  /////  2  6 

Laava  A  Hal.  /////////////////////////////////////////////////////// 

Y000576  ///// 

Laava  A  Hoi.  /////////////////////////////////////////////////////// 

Y_005 _  ///// 

Other  /////////////////////////////////////////////////////// 

Y_006 _  /////  2 

/////////////////////////////////////////////////////// 

///// 

/////////////////////////////////////////////////////// 

///// 

///////////////////////////////////////////////////////  . 
///// 

/////////////////////////////////////////////////////// 

///// 

///// - 

TOTAL  OXRECT  A  INOIRECT  8886888888 


NAME 

MARK  I.  TRAINEE 


GRAOE/RAfK 
I  GS-9 


SSN 

I  345-86-9054 


0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 


80 


REGION 

HG 


SIGNATURE: 
APRROVEO  BY: 


I  PERS  CATEGORY  1  1  AUDITOR  4  MGT  SUPPORT 
—(enter  "1"  in  1  2  AUO  MGT  5  AOMIN  SUPT 
I  category)  3  CONSULT 


Figure  3.18  Sample  Individual  Time  Report  #3. 


(GOTO} 953 1  ratom ) 

/DSRO .  {RIGHT)  {RIGHT)  {RIGHT)  {END)  {RIGHT) {END) (DO»M> I  return  IP(RIGHT)  (  return  )0 
( return )GCG0T0)R53t return ) 

/C(  return  WALK  return ){  DOM) 

/Cl  return WAL2I return  I 

/XISEXACT I VAL2 . “  "  II return I/X6A2SI  return) 

/XISEXACTI VAL1  ,VAL2  )l  return  KDOM)/XGA10(  return ) 

/HIRCDOtM)  {DOWN)  I  return  ){R1GHT) {RIGHT) 

(BACKSLASH )-(  return )  CLEFT)  {DOM)STOTL(  return) 

CLEFT) CUP) CUP)/CI  return KDQHN) {DOM)  I  return ) {RIGHT) CDOHN) (DOHN) 

CRIGHDSSUHI  CUP) CENOKUP) .  CENO)  CDOHN)  (UP)  I  return )  II  return ) 

{ UP ) /C { DOM) ( return  I . {RIGHT) {RIGHT) {RIGHT) {RIGHT) 
{RIGHT)CRIGHT}{RIGHT)<RIGHT)CRIGHT}( return ) 

CDOHN)  CDOHN)  COOM)  CLEFT)  CLEFT) 

/Cl  return  WALK  return ) 

/XISEXACTI VAL1»"  "  11  return  I/XCA23I  return ) 

{DOM1/XGA101  return ) 

(RIGHT)  {RIGHT)  I  BACKSLASH  >-l  return  KLE FT)  {OOHN)STOTLI  return ) 

(LEFT) CUP) (UP)/CI  return  KOONN) (DOM) I  return) (RIGHT) (DOtM) (DOW) 

CRIGHDSSUHI  (UPKENO) (UP) .  CENO)  (DOtM) (UP)  I  return  i )(  return ) 

(UP)/C{OOHN) I  return ) . {RIGHT} {RIGHT) {RIGHT) (RIGHT) 

(RIGHT) (RIGHT) (RIGHT) {RIGHT } {RIGHT ) I  return ) 

CDOHN){LEFT)/CI  return  WALK  return  I 
/XISEXACTI  VAL1»"ST0TL"  )l  return  J/XGA3K  return ) 

/XISEXACTI  VAL1,"  "  X  return  )/XOA3*l  return ) 

(LEFTI/RV .  (END) (RIGHT) I  return  KLEFT) CLEFT)  (ENO) CDOtM)  {END)  CLEFT) (RIGHT) 
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Figure  3.19  Blank  Consolidated  Time  Report  Showing  the  Macro. 
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Figure  3.20  Consolidated  Time  Report  Showing  Aggregate  Data. 
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1.  Obtain  background  information  useful  in  planning  and 
conducting  tha  audit.  This  type  information  can  ba  acquired  from 
sources  such  as  activity  organizational  manuals*  command 
briefings*  reports  submitted  to  higher  authority*  and  interviews. 

2.  Review  all  reports  of  audits*  examinations*  inspections*  and 
surveys  by  GAO*  NAVAUDSVC*  NAVINSGEN*  and  other  activities  since 
the  last  internal  audit *  determine  trends*  problems*  and 
corrective  actions  proposed*  appraise  the  adequacy  of  the  actions 
proposed*  i.e.»  does  it  appear  the  problem  will  be  resolved? 

1  When  reporting  e  continuing  deficiency  in  the  current  report* 
reference  may  be  made  to  tha  other  reports*  except  that  Navy 
Command  Inspection  Reports  will  not  be  referenced  as  the 
information  contained  therein  is  privileged  internal  Navy 
communication  and  releasable  only  upon  authorization  of  the 
Inspection  General ) . 

3.  Interview  cognizant  personnel  of  the  activity  and*  if 
appropriate*  associated  with  the  activity  (e.g.*  project  offices 
and  seniors  in  the  chain  of  command)  to  ascertain  their  concerns 
and  how  the  audit  could  be  the  most  useful. 


Figure  3.21  Original  Document  Before  Revision. 


1.  Obtain  background  information  useful  in  planning*  and 
controlling  the  audit.  This  type  information  can  be  acquired  from 
sources  such  as  activity  organizational  manuals*  command 
briefings*  reports  submitted  to  headquarters*  and  interviews. 

2.  Review  all  reports  of  audits*  examinations*  inspections*  and 
surveys  by  GAO,  NAVAUDSVC,  NAVINSGEN,  and  other  activities  since 
the  last  internal  audit.  Determine  trends*  problems ,  and 
corrective  actions  proposed*  appraise  the  adequacy  of  the  actions 
proposed*  i.a.»  does  it  appear  the  problem  will  be  resolved? 

( When  reporting  a  continuing  deficiency  in  the  current  report* 
reference  may  be  made  to  the  other  reports  except  that  Navy 
Command  Inspection  Reports  will  not  be  referenced  as  the 
information  contained  therein  is  privileged  internal  Navy 
communication  and  releasable  only  upon  authorization  of  the 
Inspector  General). 

3.  Interview  cognizant  personnel  of  the  activity  and,  if 
appropriate,  associated  with  the  activity  (e.g.,  project  offices 
and  seniors  in  the  chain  of  command)  to  ascertain  their  concerns 
and  how  the  audit  could  be  the  most  useful. 


Figure  3.22  Original  Document  After  Revision. 
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Figure  3.23  Output  From  FlLECOMP.EXE. 


Figure  3.24  Microsoft  Chart  Graphics. 
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Figure  3.26  PC  Project  Manager  Main  Menu. 
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Figure  3.29  Completed  Inventory  Verification  Work  Paper. 
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Figure  3.29  Completed  Inventory  Verification  Work  Paper,  (corn'd.) 


Figure  3.30  Graphic  Display  of  Inventory  Analysis. 
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Figure  3.31  Sidekick  Main  Menu. 
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Figure  3.32  PC-Deskmate  Main  Menu,  Alarm  Clock,  and  Calculator. 


APPENDIX  C 

PRIVATE  INDUSTRY  a^/^[^}y§OVERNMENT  SURVEY 


TABLE  26 

AUDIT  ORGANIZATIONS  SURVEYED 


NAME 

1.  American  President  Companies 

2.  BankAmerica  Corporation 

3.  Bergen  Brunswig  Corporation 

4.  Bechtel  Power  corporation 

5 .  Carnation  Company 

6.  Castle  &  Cooke  Incorporated 

7.  Chevron  Services  Company 

8.  Del  Monte  Corporation 

9.  Deloitte  Haskins  &  Sells 

10.  Di  Giorgio  Corporation 

11.  First  Interstate  Bankcorp 

12.  Grant  Thornton 

13.  Hilton  Hotels  Corporation 

14.  Kaiser  Aluminum  &  Chemical  Corporation 

15.  KMG  Main  Hurdman,  CPA's 

16.  Laventhol  &  Horwath 

17.  Lear  Siegler  Incorporated 

18.  Levi  Strauss  &  Company 

19.  Mattel  Incorporated 

20.  MCA  Incorporated 

21 .  Mervyns 

22.  McKesson  Corporation 

23.  National  Semiconductor 

24.  Nothrup  Corporation 

25.  Occidental  Petroleum  Corporation 

26.  Pacific  Gas  &  Electric  Company 

27.  Pacific  Lighting  Corporation 

28.  Pacific  Telesis  Group 

29.  Peat,  Marwick,  Mitchell  Company 

30.  Price  Waterhouse  &  Company 


TABLE  26 

AUDIT  ORGANIZATIONS  SURVEYED  (CONT'D.) 


31.  Santa  Fa  International  Corporation 

32.  Security  Pacific  Corporation 

33.  Southern  Pacific  Transportation  Company 

34.  Touche  Ross  &  Company  • 

35.  Union  Bankcorp 

36.  United  States  Air  Force,  Air  Force  Audit  Agency 

37.  United  States  Department  of  Agriculture,  Office  of 

Inspector  General 

1.  United  States  Department  of  Defense,  Office  of 
Inspector  General 

39.  United  States  Department  of  Labor,  Office  of 

Inspector  General 

40.  United  States  Department  of  Transportation,  Office 

of  Inspector  General 

41.  Utah  International  Incorporated 

42.  Walt  Disney  Company 

43.  Whittaker  Corporation 


APPENDIX  D 

THESIS  SURVEY  QUESTIONNAIRES 


TABLE  27 

PRIVATE  INDUSTRY  AND  FEDERAL  GOVERNMENT 
QUESTIONNAIRE 


THESIS  QUESTIONNAIRE 

Instructions :  Check  appropriate  responses  for  each 
question.  More  than  one  response  may  be  checked  for 
several  questions.  In  addition,  add  comments  where 
appropriate. 


1.  Types  of  audits  performed 

a.  Financial 

b.  Operational 

c.  Special  studies  requested  by  management 

2.  Functional  areas  reviewed  in  Operational  audits 

a.  Personnel 

b.  Timekeeping 

o.  Supply/ Inventory 

.  d.  Warehousing 

e.  Payroll 

f.  Budgeting 

g.  Cash  Management 

n.  Disbursement/Bill  Paying 

i.  Contracting/Procurement 

i .  Fixed  Assets 

K.  Maintenance  and  Repair 

l.  Manufacturing  and  Production 

m.  Transportation 

n.  Communications 

o.  Data  Processing 

p.  Other  (List) 
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TABLE  27 

PRIVATE  INDUSTRY  AND  FEDERAL  GOVERNMENT 
QUESTIONNAIRE  (CONT'D.) 


3.  Audit  program  usage 

(Indicate  percentage  of  use.  Modification  or  partial 
completion  of  standard  programs  should  be  included 
under  standard  program  use . ) 

a.  In  what  percentage  of  audit  applications  are 
standard  audit  programs  used? 

76%  -  100% 

51%  -  75% 

26%  -  50% 

1%  -  25% 

Never 

b.  In  what  percentage  of  audit  applications  are  unique 
audit  programs  developed  for  audits? 

76%  -  100% 

51%  -  75% 

26%  -  50% 

1%  -  25% 

Never 

4.  Microcomputer  applications 

a.  Electronic  Workpapers 

b.  Report  Writing 

c .  Audit  Management 

d.  Data  Analysis 

e.  Statistical  Sampling 

f.  Audit  Presentations 

g.  Graphics 

n.  Telecommunications 

i.  Other  (List) 

5.  Audit  software 

a.  Are  standard  software  packages  used? 

b.  Are  custom  audit  programs  written  using  high  level 
programming  languages  such  as  COBOL,  BASIC,  and  PASCAL? 

c.  If  answer  to  b.  is  yes  please  give  a  general 
description  of  the  programs  developea. 


TABLE  27 

PRIVATE  INDUSTRY  AND  FEDERAL  GOVERNMENT 
QUESTIONNAIRE  (CONT'D.) 


d.  Commercial  software  used 

Type  Name 

1)  Word  Processing 

2)  Spreadsheet 

3  Graphics 

4)  Project  Management 

5)  Data  Base 

6)  Accounting 

7)  Utilities 

-  8)  Telecommunication 

9)  Statistics 

10)  Integrated  Packages 

11)  Other  (List) 

6.  Who  uses  microcomputers 

a.  All  Auditors 

b.  EDP  Auditors  only 

c.  Specially  trained  auditors 

d.  Audit  managers 

e.  Technical  specialists 

f.  Reviewers 

7.  Where  are  microcomputers  used 

a.  On-Site  (i.e.  Portables) 

b.  HQ/  Audit  Office 

8.  Please  add  any  other  comments  concerning  your  use  of 
microcomputers  in  the  audit  function  which  you  think  are 
appropriate  or  of  interest  for  our  study. 
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TABLE  28 

NAVAL  AUDIT  SERVICE  QUESTIONNAIRE 


THESIS  QUESTIONNAIRE  FOR  NAVAL  AUDIT  SERVICE 

OPNAV  Report  Control  Symbol:  RCS-7510-01 

Instructions:  Check  appropriate  responses  for  each 
question.  More  than  one  response  may  be  checked  for  several 
questions.  Please,  add  comments  where  appropriate. 

1.  Position: 

a.  Auditor 

b.  Auditor  in  Charge 

2.  How  long  have  you  had  the  microcomputer  at  your  site. 

a.  Less  Than  3  Honths 

b.  3  -  6  Months 

c.  6  -  9  Months 

d.  9  -  12  Months 

e.  Greater  than  12  Months 

3.  List  your  previous  experience  with  using  microcomputers. 

a.  None 

b.  Previous  job 

c.  College 

d.  Home  (have  your  own  PC) 

4.  Audit  usage  information 

a.  List  the  functional  areas  for  which  microcomputers  were 
used. 

(  Use  functional  area  identification  numbers  from  timesheet) 

b.  List  the  Naval  Audit  Service  audit  programs  used  to  review 

these  functional  areas.  Indicate  the  audit  program  number 
and  where  possible  the  specific  audit  step  number. 

Program  Number  Step  Number  Software  Used 
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NAVAL  AUDIT  SERVICE  QUESTIONNAIRE  (CONT'D.) 


c.  Can  these  applications  be  used  for  other  audits? 

1.  Yes,  the  next  time  this  audit  is  performed  (same  activity) 

2.  Yes,  for  audits  of  the  same  type  of  activity. 

3.  Yes,  every time  this  audit  program  step  is  performed. 

4.  Unable  to  determine  at  this  time. 

5.  No 

5.  Applications  which  the  microcomputers  were  used  for. 

a.  Electronic  Workpapers 

b.  Word  Processing  (braft  findings,  survey  debriefs,  etc.) 

c.  Audit  Management  (Audit  planning,  personnel  management  etc.) 

d.  Data  Analysis  (Speadsheets,  data  base) 

e.  Statistical  Sampling 

f.  Audit  Presentations 

S.  Graphics 
.  Telecommunications 
i.  Other  (List) 

6.  Identify  the  benefits  (if  any)  from  using  the 
microcomputer  for  these  applications. 

a.  Better  looking  output 

b.  Enhanced  reliability  in  statistical  sampling 

c.  Enhanced  reliability  of  data*  analysis 

d.  Less  time  spent  on  repetitive  tasks 

e.  Ability  to  review  larger  amounts  of  data 

f.  Other  (List) 

7.  Were  there  any  applications  that  you  wanted  to  do  but 
were  unable  to? 

(Please  give  a  general  description  of  them.) 

8.  How  do  you  think  Naval  Audit  Service  should  integrate 
microcomputers  into  day  to  day  operations? 

a.  Headquarters  should  develop  standard  software  applications 
for  audit  program  steps  and  administrative  tasks, 

b.  Users  should  develop  their  own  applications  and 

distribute  them  to  other  auditors  via  a  NAS  computer 
newsletter  or  an  electronic  bulletin  board, 

c.  Standard  routines  should  be  developed  for  repetitive 
administrative  tasks  but  audit  applications  should  be 
developed  each  time  an  audit  is  performed, 

d.  Other 
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NAVAL  AUDIT  SERVICE  QUESTIONNAIRE  (CONT'D.) 


9.  List  any  other  software  programs  or  types  of  programs  you  think 
Naval  Audit  Service  should  purchase  for  the  microcomputers. 

10.  What  is  your  biggest  problem  in  using  microcomputers? 

a.  Lack  of  formal  training 

b.  Reliability  of  hardware 

c.  Poor  software  documentation 

d.  Access  to  a  free  machine 

e.  Time  required  to  learn  how  to  use  it 

f.  Developing  the  right  application 

g.  Other  (Describe) 

11.  What  is  your  opinion  of  the  potential  level  of 
microcomputer  use  for  audit  ana  administrative  tasks? 

Audit  Tasks  Administrative  Tasks 

a.  High  High 

b.  Medium  Medium 

c.  Low  Low 
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APPENDIX  E 

SOFTWARE  DEVELOPMENT  ORGANIZATIONS 


American  Business  Systems  Inc 
3  Littleton  Rd 
Westford  MA  01886 

Applied  Microsvstems,  Inc. 

P.u.  Box  832  ' 

Roswell  GA  30077 

Applied  Operations  Research 
22056  Saticov  St. 

Canoga  Park'  CA  91303 

10150  VfJffersonB 
Culver  City  CA  9<L 

Best  Programs 

i^afebU?AP%02 

Data  Consulting  Group 
12  Skvlark  Dr.  318 
Larkspur  CA  94939 


1 

230 


Data  Ear 
12  Skvlarl 
Larkspur 


<?A  §4939 


AvS 
55344 

crosystems  Inc. 


1701  N  Fort^Iyer  Dr. 
Sixth  Floor 
Arlington  VA  22209 

Fox  &  Geller,  Inc. 

M  Market  St. 
lmwood  Park  NJ  07666 


Gavel  Com 
Rt.  2,  B 
Alacual 


„^...ijnuing  Systems,  Inc. 
2,  ?°|^2615 


Glenco  Engineering 
3920  RidgesAve. 

Arlington  Heights  IL  60004 

Hemming  Morse,  Inc. 

S  ElCamino^ReaL  #320 


1700 
San  > 


Mateo  CA  9440; 

LWFW,  Inc.  Group 
12700  Park  Centraf 
#  1805 

Dallas  TX  75251 
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